CVE-2026-52490

A flaw was found in libtiff. An attacker can exploit a vulnerability in the process_command_opts() function within tools/tiffcrop.c to execute arbitrary code. This could lead to a complete compromise of the affected system.

Red Hat has classified this flaw as Important rather than Moderate because an attacker who convinces a user or automated process to run the utility with crafted arguments could execute arbitrary instructions in the security context of the invoking account. This issue is isolated to the standalone tiffcrop binary and does not reside in the core libtiff shared library, meaning third-party software and background system daemons dynamically linked against libtiff remain unaffected. Exploitation requires specific invocation of the CLI tool with malicious command-line options, significantly limiting direct exposure in standard server deployments where the utility is not integrated into automated pipelines.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using the tiffcrop utility to process TIFF image files from untrusted sources. If the libtiff-tools package, which provides tiffcrop, is not required, consider removing it to prevent exploitation.