CVE-2026-18495

Public on 2026-09-11
Modified on 2026-09-11
Description
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
6.6
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core compat-libtiff3 Not Affected
Amazon Linux 2 - Core libtiff Pending Fix
Amazon Linux 2023 libtiff Pending Fix
Amazon Linux 2027 Preview libtiff Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H