CVE-2026-52492

A flaw was found in libtiff. An integer overflow vulnerability exists in the cvtRaster() function of the rgb2ycbcr utility. When processing a specially crafted TIFF image during YCbCr conversion, an attacker could trigger an undersized heap allocation, leading to a heap-based buffer overflow. This could potentially allow for arbitrary code execution.

Red Hat Product Security has rated this vulnerability as Important because, although triggering it requires user interaction with an untrusted file, memory corruption can allow arbitrary code execution within the running application's context. The flaw resides specifically within the standalone rgb2ycbcr command-line utility rather than the core libtiff shared library. As a result, standard applications linking against libtiff.so are not directly exposed unless external workflows or scripts invoke this specific tool to convert image color spaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing untrusted or maliciously crafted TIFF images with the rgb2ycbcr utility. Users should exercise caution when handling TIFF files from unknown or suspicious sources.