CVE-2026-18495: libtiff Buffer Overflow Vulnerability

CVE-2026-18495 Overview

A heap buffer overflow vulnerability exists in the tiff2pdf utility of libtiff. The flaw stems from an integer truncation error when processing crafted BigTIFF files. An attacker can supply a specially crafted BigTIFF file that causes a 64-bit StripByteCounts value to be truncated to a 32-bit integer. This truncation results in an undersized heap allocation followed by an out-of-bounds memory copy, producing memory corruption and application crash. The vulnerability is categorized as heap-based buffer overflow [CWE-122].

Critical Impact
Local attackers can trigger heap memory corruption and denial of service in tiff2pdf by supplying a crafted BigTIFF file, with potential for further exploitation depending on runtime context.

Affected Products

libtiff tiff2pdf utility
Red Hat Enterprise Linux distributions shipping libtiff (see RHSA-2026:53467)
Downstream applications and conversion pipelines that invoke tiff2pdf on untrusted BigTIFF input

Discovery Timeline

2026-09-11 - CVE-2026-18495 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-18495

Vulnerability Analysis

The defect resides in the BigTIFF handling code path of the tiff2pdf utility. BigTIFF extends the classic TIFF format by using 64-bit offsets and 64-bit counters, including the StripByteCounts tag that records per-strip byte lengths. When tiff2pdf reads this 64-bit value from a crafted image, the code truncates it into a 32-bit integer variable during arithmetic or assignment. The truncated value is then used to size a heap buffer via allocation routines. Because the allocation reflects only the lower 32 bits, the buffer is smaller than the data that follows. The subsequent copy operation writes past the end of the allocated region, corrupting adjacent heap metadata and neighboring chunks. This class of defect is a numeric truncation error leading to a heap-based buffer overflow.

Root Cause

The root cause is improper handling of 64-bit BigTIFF counters within code paths that still use 32-bit integer types for size arithmetic. Missing bounds validation on StripByteCounts before allocation compounds the issue.

Attack Vector

Exploitation requires local access with low privileges and user interaction. A victim must run tiff2pdf against an attacker-supplied BigTIFF file. This pattern is common in document conversion services, print pipelines, and file preview features.

No verified public proof-of-concept code is available. Refer to the GitLab Merge Request #729 for the upstream fix and to the Red Hat CVE Report CVE-2026-18495 for advisory details.

Detection Methods for CVE-2026-18495

Indicators of Compromise

Crashes or abnormal termination of tiff2pdf processes when handling .tif or .tiff inputs, especially BigTIFF files.
Heap corruption signatures reported by AddressSanitizer, glibc malloc checks, or core dumps referencing tiff2pdf frames.
BigTIFF files with unusually large or malformed StripByteCounts values whose high 32 bits are non-zero.

Detection Strategies

Monitor process execution telemetry for tiff2pdf invocations against files originating from untrusted paths such as upload directories or user mail attachments.
Enable ASan or hardened allocator tooling in test and staging environments to surface heap overflows during BigTIFF parsing.
Inspect BigTIFF headers (magic number 0x2B) and validate strip metadata against file size before conversion.

Monitoring Recommendations

Log all conversion jobs that transform TIFF or BigTIFF into PDF, including source hash, size, and exit status.
Alert on repeated tiff2pdf crashes originating from the same user, service account, or upload endpoint.
Track installed libtiff package versions across the fleet and flag hosts running unpatched builds.

How to Mitigate CVE-2026-18495

Immediate Actions Required

Apply the vendor-supplied libtiff update referenced in Red Hat Security Advisory RHSA-2026:53467 on affected systems.
Restrict use of tiff2pdf to trusted files only and sandbox conversion services that process user-supplied images.
Audit build pipelines and container images for bundled libtiff versions and rebuild with the patched library.

Patch Information

The upstream fix is delivered through GitLab Merge Request #729 in the libtiff repository. Red Hat distributes the patched packages through RHSA-2026:53467. Rebuild any statically linked binaries or containers that embed libtiff after upgrading.

Workarounds

Disable or remove the tiff2pdf utility on hosts that do not require TIFF-to-PDF conversion.
Pre-validate uploaded TIFF files and reject BigTIFF inputs, identified by the little-endian II\\x2B\\x00 or big-endian MM\\x00\\x2B magic, until patches are deployed.
Run conversion workloads under a low-privilege service account with filesystem and syscall restrictions using tools such as seccomp or bubblewrap.

bash

# Configuration example: identify and reject BigTIFF files before conversion
file --mime-type input.tiff | grep -q 'image/tiff' || exit 1
head -c 4 input.tiff | xxd | grep -Eq '2b00|002b' && { echo 'BigTIFF rejected'; exit 1; }
tiff2pdf -o output.pdf input.tiff