Skip to content
Fencer Vulns
high 7.8

CVE-2026-4775 json

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

published 2026-03-24 7 mo ago modified 2026-11-04 4 d ago also EUVD-2026-14901

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:4.6.0-6.el10_1.3, 0:4.6.0-8.el10_2.1
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:4.6.0-6.el10_0.3
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:3.9.4-12.el7_9.2, 0:4.0.3-35.el7_9.2
  • Red Hat Red Hat Enterprise Linux 8 0:3.9.4-15.el8_10, 0:4.0.9-4.el8_10, 0:4.0.9-37.el8_10
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:3.9.4-13.el8_4.2, 0:4.0.9-18.el8_4.2
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:3.9.4-13.el8_4.2, 0:4.0.9-18.el8_4.2
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:3.9.4-13.el8_6.2, 0:4.0.9-21.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:3.9.4-13.el8_6.2, 0:4.0.9-21.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:3.9.4-13.el8_6.2, 0:4.0.9-21.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:3.9.4-13.el8_8.2, 0:4.0.9-29.el8_8.2
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:3.9.4-13.el8_8.2, 0:4.0.9-29.el8_8.2
  • Red Hat Red Hat Enterprise Linux 9 0:4.4.0-15.el9_7.3, 0:4.4.0-18.el9_8
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:4.2.0-3.el9_0.3
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:4.4.0-8.el9_2.5
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:4.4.0-12.el9_4.5
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:4.4.0-13.el9_6.4
  • Red Hat Red Hat AI Inference Server 3.2 1780681984
  • Red Hat Red Hat AI Inference Server 3.3 1782352847, 1782352919, 1782352950, 1782353093
  • Red Hat Red Hat Hardened Images 4.7.1-2.2.hum1, 4.7.1-2.3.hum1
  • Red Hat Red Hat OpenShift AI 3.4 1790703542
  • tiff Debian 12 4.5.0-6+deb12u4
  • tiff Debian 13 4.7.0-3+deb13u2
  • tiff Debian 14 4.7.1-2

debian advisories DEBIAN-CVE-2026-4775

  • libtiff hummingbird 1 4.7.1-2.3.hum1
  • libtiff-tools hummingbird 1 4.7.1-2.3.hum1
  • libtiff hummingbird 1 4.7.1-2.2.hum1
  • libtiff-tools hummingbird 1 4.7.1-2.2.hum1
  • compat-libtiff3 RHEL 8 3.9.4-15.el8_10
  • libtiff RHEL 9 4.4.0-18.el9_8
  • libtiff-tools RHEL 9 4.4.0-18.el9_8
  • libtiff RHEL 10.2 4.6.0-8.el10_2.1

red hat advisories RHSA-2026:33388RHSA-2026:30349RHSA-2026:25910RHSA-2026:24992RHSA-2026:20592RHSA-2026:20591

  • tiff SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Package Hub 15 SP7 +1 more 4.7.2-150600.3.29.1
  • tiff SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.7.2-160000.1.1
  • tiff SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.7.1-160000.2.1

suse advisories SUSE-SU-2026:2853-1SUSE-SU-2026:22590-1SUSE-SU-2026:22616-1SUSE-SU-2026:22234-1SUSE-SU-2026:22306-1

  • python-Pillow openSUSE Tumbleweed 12.3.0-1.1
  • tiff openSUSE Leap 16.0 4.7.2-160000.1.1
  • tiff-man openSUSE Leap 16.0 4.7.2-160000.1.1
  • tiff openSUSE Leap 16.0 4.7.1-160000.2.1
  • tiff-man openSUSE Leap 16.0 4.7.1-160000.2.1
  • tiff openSUSE Tumbleweed 4.7.1-5.1

opensuse advisories openSUSE-SU-2026:11261-1openSUSE-SU-2026:21289-1openSUSE-SU-2026:20995-1openSUSE-SU-2026:10650-1

  • compat-libtiff3 AlmaLinux 8 3.9.4-15.el8_10
  • libtiff AlmaLinux 10 4.6.0-8.el10_2.1
  • libtiff-tools AlmaLinux 10 4.6.0-8.el10_2.1
  • libtiff AlmaLinux 9 4.4.0-18.el9_8
  • libtiff-tools AlmaLinux 9 4.4.0-18.el9_8
  • libtiff AlmaLinux 8 4.0.9-37.el8_10
  • libtiff-tools AlmaLinux 8 4.0.9-37.el8_10
  • mingw32-libtiff AlmaLinux 8 4.0.9-4.el8_10

almalinux advisories ALSA-2026:20585ALSA-2026:19150ALSA-2026:19363ALSA-2026:16055ALSA-2026:14929ALSA-2026:12265

  • libtiff Rocky Linux 10 4.6.0-8.el10_2.1
  • compat-libtiff3 Rocky Linux 8 3.9.4-15.el8_10
  • libtiff Rocky Linux 9 4.4.0-18.el9_8
  • libtiff Rocky Linux 8 4.0.9-37.el8_10
  • mingw-libtiff Rocky Linux 8 4.0.9-4.el8_10
  • libtiff Rocky Linux 10 4.6.0-6.el10_1.3
  • libtiff Rocky Linux 9 4.4.0-15.el9_7.3

rocky linux advisories RLSA-2026:19150RLSA-2026:20585RLSA-2026:19363RLSA-2026:16055RLSA-2026:14929RLSA-2026:12265

  • tiff Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 4.7.2-r0
  • qt6-qtwebengine Alpine 3.23 6.10.3-r3
  • qt6-qtwebengine Alpine 3.24 6.11.0-r9

alpine advisories ALPINE-CVE-2026-4775

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libtiff Azure Linux 3.0 4.6.0-13

azure linux advisories AZL-80919

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-4775 updated cvss 7.8

libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing

  • Red Hat Enterprise Linux 6 libtiff
    affected: workaround, no fix available
  • Red Hat AI Inference Server 3.2 rhaiis/model-opt-cuda-rhel9 1780681984
    fixed: vendor fix RHSA-2026:25096
  • Red Hat AI Inference Server 3.3 rhaiis/vllm-cuda-rhel9 1782352847, rhaiis/vllm-rocm-rhel9 1782353093, rhaiis/vllm-spyre-rhel9 1782352919, rhaiis/model-opt-cuda-rhel9 1782352950
    fixed: vendor fix RHSA-2026:30078
  • Red Hat CodeReady Linux Builder EUS (v.9.4) libtiff-tools 4.4.0-12.el9_4.5
    fixed: vendor fix RHSA-2026:19702
  • Red Hat CodeReady Linux Builder EUS (v.9.6) libtiff-tools 4.4.0-13.el9_6.4
    fixed: vendor fix RHSA-2026:19585
  • Red Hat Enterprise Linux AppStream (v. 8) libtiff 4.0.9-37.el8_10, compat-libtiff3 3.9.4-15.el8_10
    fixed: vendor fix RHSA-2026:20585
  • Red Hat Enterprise Linux AppStream (v. 9) libtiff 4.4.0-18.el9_8, libtiff 4.4.0-15.el9_7.3
    fixed: vendor fix RHSA-2026:12271
  • Red Hat Enterprise Linux AppStream (v. 10) libtiff 4.6.0-6.el10_1.3, libtiff 4.6.0-8.el10_2.1
    fixed: vendor fix RHSA-2026:12265
show 19 more
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) libtiff 4.0.9-18.el8_4.2, compat-libtiff3 3.9.4-13.el8_4.2
    fixed: vendor fix RHSA-2026:20583
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) libtiff 4.0.9-21.el8_6.2, compat-libtiff3 3.9.4-13.el8_6.2 Red Hat Enterprise Linux AppStream E4S (v.8.6) libtiff 4.0.9-21.el8_6.2, compat-libtiff3 3.9.4-13.el8_6.2
    fixed: vendor fix RHSA-2026:20591
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) libtiff 4.0.9-29.el8_8.2, compat-libtiff3 3.9.4-13.el8_8.2
    fixed: vendor fix RHSA-2026:20592
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) libtiff 4.2.0-3.el9_0.3
    fixed: vendor fix RHSA-2026:19608
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) libtiff 4.4.0-8.el9_2.5
    fixed: vendor fix RHSA-2026:19609
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libtiff 4.6.0-6.el10_0.3
    fixed: vendor fix RHSA-2026:19586
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) libtiff 4.4.0-12.el9_4.5
    fixed: vendor fix RHSA-2026:19702
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) libtiff 4.4.0-13.el9_6.4
    fixed: vendor fix RHSA-2026:19585
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libtiff 4.0.9-18.el8_4.2, compat-libtiff3 3.9.4-13.el8_4.2
    fixed: vendor fix RHSA-2026:20583
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) libtiff 4.0.9-21.el8_6.2, compat-libtiff3 3.9.4-13.el8_6.2
    fixed: vendor fix RHSA-2026:20591
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) libtiff 4.0.9-29.el8_8.2, compat-libtiff3 3.9.4-13.el8_8.2
    fixed: vendor fix RHSA-2026:20592
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libtiff-tools 4.4.0-18.el9_8, libtiff-tools 4.4.0-15.el9_7.3
    fixed: vendor fix RHSA-2026:12271
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libtiff-tools 4.6.0-6.el10_1.3, libtiff-tools 4.6.0-8.el10_2.1
    fixed: vendor fix RHSA-2026:12265
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libtiff-tools 4.6.0-6.el10_0.3
    fixed: vendor fix RHSA-2026:19586
  • Red Hat Enterprise Linux CRB (v. 8) mingw-libtiff 4.0.9-4.el8_10, libtiff-tools 4.0.9-37.el8_10, mingw32-libtiff 4.0.9-4.el8_10, mingw64-libtiff 4.0.9-4.el8_10
    fixed: vendor fix RHSA-2026:16055
  • Red Hat Enterprise Linux Server (v. 7 ELS) libtiff 4.0.3-35.el7_9.2, compat-libtiff3 3.9.4-12.el7_9.2
    fixed: vendor fix RHSA-2026:24992
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS) libtiff-tools 4.0.3-35.el7_9.2
    fixed: vendor fix RHSA-2026:25910
  • Red Hat Hardened Images libtiff 4.7.1-2.2.hum1, libtiff 4.7.1-2.3.hum1, libtiff-tools 4.7.1-2.2.hum1, libtiff-tools 4.7.1-2.3.hum1
    fixed: vendor fix RHSA-2026:30349
  • Red Hat OpenShift AI 3.4 rhai/base-image-neuron-rhel9 1790703542
    fixed: vendor fix RHSA-2026:74674

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
7 mo ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat AI Inference Server 3.2
  • Red Hat Red Hat AI Inference Server 3.3
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.