Executive brief
A flaw in libtiff's tiff2pdf utility allows attackers to trigger a heap buffer overflow by submitting specially crafted BigTIFF image files. The vulnerability leads to memory corruption and application crashes, potentially enabling code execution or denial of service. Organizations using libtiff for image conversion should apply patches promptly.
Technical details
The vulnerability is a heap-buffer overflow caused by an integer truncation error in tiff2pdf when processing BigTIFF files. A 64-bit `StripByteCounts` value is truncated to a 32-bit integer during memory allocation, resulting in undersized heap allocation. An attacker can supply a malicious BigTIFF file to trigger an out-of-bounds memory copy, leading to heap corruption, crashes, and potential arbitrary code execution. The attack requires no authentication and is triggered by processing a crafted file; patch availability should be confirmed with the vendor.
Affected products
- libtiff libtiff
Timeline
- 2026-09-11: disclosed