CVE-2026-4775

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

State: Published
Severity: 7.8 High
Published: Mar 24, 2026
Updated: Oct 2, 2026
Reserved: Mar 24, 2026

Description

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	redhat
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	redhat-SADP

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
Red Hat Enterprise Linux 10Red Hat	0:4.6.0-6.el10_1.3 and laterNot affected
Red Hat Enterprise Linux 10Red Hat	0:4.6.0-8.el10_2.1 and laterNot affected
Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat	0:4.6.0-6.el10_0.3 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat	0:3.9.4-12.el7_9.2 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat	0:4.0.3-35.el7_9.2 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:4.0.9-37.el8_10 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:3.9.4-15.el8_10 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:4.0.9-4.el8_10 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	0:4.0.9-18.el8_4.2 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	0:3.9.4-13.el8_4.2 and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat	0:4.0.9-18.el8_4.2 and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat	0:3.9.4-13.el8_4.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat	0:4.0.9-21.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat	0:3.9.4-13.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat	0:4.0.9-21.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat	0:3.9.4-13.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat	0:4.0.9-21.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat	0:3.9.4-13.el8_6.2 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat	0:4.0.9-29.el8_8.2 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat	0:3.9.4-13.el8_8.2 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat	0:4.0.9-29.el8_8.2 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat	0:3.9.4-13.el8_8.2 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:4.4.0-15.el9_7.3 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:4.4.0-18.el9_8 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat	0:4.2.0-3.el9_0.3 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat	0:4.4.0-8.el9_2.5 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat	0:4.4.0-12.el9_4.5 and laterNot affected
Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat	0:4.4.0-13.el9_6.4 and laterNot affected
Red Hat AI Inference Server 3.2Red Hat	1780681984 and laterNot affected
Red Hat AI Inference Server 3.3Red Hat	1782352950 and laterNot affected
Red Hat AI Inference Server 3.3Red Hat	1782352919 and laterNot affected
Red Hat AI Inference Server 3.3Red Hat	1782353093 and laterNot affected
Red Hat AI Inference Server 3.3Red Hat	1782352847 and laterNot affected
Red Hat Hardened ImagesRed Hat	4.7.1-2.2.hum1 and laterNot affected
Red Hat Hardened ImagesRed Hat	4.7.1-2.3.hum1 and laterNot affected
Red Hat OpenShift AI 3.4Red Hat	1790703542 and laterNot affected
Red Hat Enterprise Linux 6Red Hat

References

RHSA-2026:12265vendor-advisory
RHSA-2026:12271vendor-advisory
RHSA-2026:14929vendor-advisory
RHSA-2026:16055vendor-advisory
RHSA-2026:19150vendor-advisory
RHSA-2026:19363vendor-advisory
RHSA-2026:19585vendor-advisory
RHSA-2026:19586vendor-advisory
RHSA-2026:19604vendor-advisory
RHSA-2026:19608vendor-advisory
RHSA-2026:19609vendor-advisory
RHSA-2026:19657vendor-advisory
RHSA-2026:19659vendor-advisory
RHSA-2026:19702vendor-advisory
RHSA-2026:20583vendor-advisory
RHSA-2026:20585vendor-advisory
RHSA-2026:20591vendor-advisory
RHSA-2026:20592vendor-advisory
RHSA-2026:24992vendor-advisory
RHSA-2026:25096vendor-advisory
RHSA-2026:25910vendor-advisory
RHSA-2026:30078vendor-advisory
RHSA-2026:30087vendor-advisory
RHSA-2026:30088vendor-advisory
RHSA-2026:30089vendor-advisory
RHSA-2026:30349vendor-advisory
RHSA-2026:33388vendor-advisory
RHSA-2026:74674vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-4775vdb-entry
RHBZ#2450768issue-tracking
https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.