Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
openeuler libtiff tiff2pdf may crash on malicious BigTIFF
published 1 month ago
Summary
The tiff2pdf tool that comes with libtiff on openeuler can mishandle specially crafted BigTIFF image files. This mistake can cause the program to allocate too little memory and then write beyond that memory, which may crash the application or allow further damage. Update libtiff to the latest version or avoid processing untrusted BigTIFF files until the fix is applied.
What to do
- Update openeuler libtiff to version 4.3.0-41.oe2003sp4.
- Update openeuler libtiff to version 4.3.0-55.oe2203sp4.
- Update openeuler libtiff to version 4.6.0-13.oe2403sp1.
- Update openeuler libtiff to version 4.6.0-13.oe2403sp3.
- Update openeuler libtiff to version 4.6.0-13.oe2403sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:20.03-LTS-SP4 | openeuler | libtiff |
< 4.3.0-41.oe2003sp4 Fix: upgrade to 4.3.0-41.oe2003sp4
|
| openEuler:22.03-LTS-SP4 | openeuler | libtiff |
< 4.3.0-55.oe2203sp4 Fix: upgrade to 4.3.0-55.oe2203sp4
|
| openEuler:24.03-LTS-SP1 | openeuler | libtiff |
< 4.6.0-13.oe2403sp1 Fix: upgrade to 4.6.0-13.oe2403sp1
|
| openEuler:24.03-LTS-SP3 | openeuler | libtiff |
< 4.6.0-13.oe2403sp3 Fix: upgrade to 4.6.0-13.oe2403sp3
|
| openEuler:24.03-LTS-SP4 | openeuler | libtiff |
< 4.6.0-13.oe2403sp4 Fix: upgrade to 4.6.0-13.oe2403sp4
|
Original advisory text
libtiff security update
This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.
Security Fix(es):
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.(CVE-2026-18495)
Security Fix(es):
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.(CVE-2026-18495)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-18495 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published25 Sep 2026
Updated30 Sep 2026
First seen30 Sep 2026
Sources
OESA-2026-4063 · OSV
Track software like this
Free during beta