CVE-2026-52490: libtiff tiffcrop RCE Vulnerability

CVE-2026-52490 Overview

CVE-2026-52490 is a code injection vulnerability in libtiff, the widely deployed library for reading and writing Tagged Image File Format (TIFF) files. The flaw resides in the process_command_opts() function inside tools/tiffcrop.c at commit 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938. Attackers can execute arbitrary code by supplying crafted input to the tiffcrop utility. The issue is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the user running tiffcrop, enabling full compromise of confidentiality, integrity, and availability.

Affected Products

libtiff at commit 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938
The tiffcrop utility distributed with libtiff
Downstream distributions and applications embedding the affected libtiff commit

Discovery Timeline

2026-08-24 - CVE-2026-52490 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-52490

Vulnerability Analysis

The vulnerability lives in process_command_opts() within tools/tiffcrop.c. This function parses command-line options passed to tiffcrop, which is the libtiff-provided binary used to crop, extract, and reassemble regions of TIFF images. Improper handling of option data during parsing lets an attacker influence execution flow and run arbitrary code.

The issue is tracked as CWE-94, Improper Control of Generation of Code, indicating that attacker-controlled input reaches a code generation or interpretation path without adequate validation. Public technical details are available in the GitLab Work Item #846 and an accompanying GitHub PoC gist.

Root Cause

The defect stems from insufficient validation of option arguments consumed by process_command_opts(). tiffcrop accepts a rich set of region, rotation, and page-selection options that are parsed into internal structures. When malformed values are processed at the identified commit, the parser corrupts state in a way that allows attacker-controlled data to drive execution.

Attack Vector

An attacker triggers the flaw by causing tiffcrop to run against crafted arguments or a malicious TIFF processed alongside those arguments. Automated pipelines, image-conversion services, and web backends that invoke tiffcrop on untrusted input are the primary exposure. See the public proof-of-concept for reproduction steps.

// No verified exploit code is reproduced here.
// Refer to the public PoC linked above for technical detail.

Detection Methods for CVE-2026-52490

Indicators of Compromise

Unexpected child processes spawned by tiffcrop such as shells, interpreters, or network utilities
Crashes, segmentation faults, or aborts logged by tiffcrop when processing user-supplied TIFF files
Outbound network connections originating from image-processing worker hosts that normally do not initiate egress

Detection Strategies

Inventory hosts running libtiff and identify systems built from or pinned to commit 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938
Alert on invocations of tiffcrop where arguments or file paths originate from untrusted or internet-facing sources
Monitor for anomalous execve chains where tiffcrop is the parent of non-image-processing binaries

Monitoring Recommendations

Enable process-creation and command-line auditing on Linux hosts that run TIFF conversion workloads
Collect and centralize tiffcrop exit codes and crash telemetry to detect exploitation attempts and fuzzing
Correlate image upload events with subsequent process behavior to identify weaponized TIFF payloads

How to Mitigate CVE-2026-52490

Immediate Actions Required

Identify and remove or disable the tiffcrop binary on systems where it is not required for production workflows
Rebuild libtiff from a patched commit once one is published upstream and redeploy dependent packages
Restrict tiffcrop execution to trusted, sandboxed contexts and never invoke it directly on attacker-supplied arguments

Patch Information

At the time of publication, remediation is being tracked in GitLab Work Item #846 in the upstream libtiff project. Consumers should monitor that issue and their Linux distribution's security channels for a released fix and update libtiff packages when a patched version becomes available.

Workarounds

Remove tiffcrop from production images and container base layers if it is not used
Run TIFF processing inside a minimal-privilege sandbox such as seccomp, bubblewrap, or an unprivileged container without network egress
Validate and constrain TIFF inputs at the application layer, rejecting files with unexpected structure before invoking tiffcrop

bash

# Disable execution of tiffcrop on hosts that do not require it
sudo chmod 000 "$(command -v tiffcrop)"

# Verify the installed libtiff version and commit provenance
dpkg -l | grep -i libtiff
rpm -qi libtiff 2>/dev/null