Executive brief
libtiff is a widely-used library for reading and writing TIFF image files. An integer overflow in the rgb2ycbcr color conversion tool can cause a heap buffer overflow when processing a malicious TIFF image, potentially allowing an attacker to crash the application or execute arbitrary code.
Technical details
An integer overflow exists in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes for YCbCr color space conversion. The vulnerability occurs during size calculations for heap allocation, resulting in an undersized buffer that is subsequently written to during TIFF image processing. An attacker can craft a malicious TIFF image to trigger the integer overflow, leading to a heap-based buffer overflow. This requires local access and user interaction (opening the malicious TIFF file), but can result in information disclosure, denial of service, or code execution. A fix is available in commit 94affc5c which adds conversion warnings to catch such issues.
Affected products
- libtiff libtiff prior to commit 94affc5c (released December 29, 2025)
Timeline
- 2026-08-24: disclosed: CVE published
- 2025-12-29: other: Fix commit 94affc5c merged