CVE-2026-18495

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

This vulnerability is classified as having a Moderate impact because exploitation is restricted to the standalone tiff2pdf conversion utility and requires an attacker to convince a user or automated pipeline to process a specially crafted BigTIFF image. Core shared libraries in libtiff and standard Red Hat Enterprise Linux system services do not expose this functionality over the network by default. While memory corruption or denial of service through an application crash can occur, the blast radius is strictly limited to the privileges of the local process executing the tool.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.