LibTIFF rgb2ycbcr cvtRaster integer overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in LibTIFF. The affected element is the function cvtRaster of the component rgb2ycbcr. The manipulation leads to integer overflow. This vulnerability is traded as CVE-2026-52492. It is possible to initiate the attack remotely. There is no exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in LibTIFF (affected version unknown). It has been rated as critical. This issue affects the function cvtRaster of the component rgb2ycbcr. The manipulation with an unknown input leads to a integer overflow vulnerability. Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

The advisory is shared at gitlab.com. The identification of this vulnerability is CVE-2026-52492 since 06/08/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 339482 (Linux Distros Unpatched Vulnerability : CVE-2026-52492), which helps to determine the existence of the flaw in a target environment.

Applying the patch 94affc5cf54111312f9891eb77accb93eebc28d7 is able to eliminate this problem.

The vulnerability is also documented in the databases at Tenable (339482) and EUVD (EUVD-2026-65145). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Image Processing Software

Name

• LibTIFF

License

• open-source

Website

• Product: http://www.libtiff.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion