CVE-2026-18495 Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough
An attacker can trigger memory corruption and potential code execution by providing a crafted BigTIFF file to the tiff2pdf utility due to integer truncation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-18495?
CVE-2026-18495 is a medium-severity vulnerability in Red Hat Ceph Storage 4, published on 11 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.
Weakness: CWE-122
Which versions are affected by CVE-2026-18495?
Linux distribution packages (5)
tiff SUSE:Linux Enterprise Micro 5.3 | All versions | 4.0.9-150000.45.72.1 |
tiff SUSE:Linux Enterprise Micro 5.4 | All versions | 4.0.9-150000.45.72.1 |
tiff SUSE:Linux Enterprise Micro 5.5 | All versions | 4.0.9-150000.45.72.1 |
tiff SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 4.0.9-150000.45.72.1 |
tiff SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 4.0.9-44.118.1 |
How do I fix CVE-2026-18495?
Apply the vendor's patch.
Is CVE-2026-18495 being exploited?
There is no known exploitation of CVE-2026-18495 in the wild and no public exploit code.
Sources
Also known as AZL-101736, BELL-CVE-2026-18495, DEBIAN-CVE-2026-18495, ECHO-43b5-a32b-c56f, GHSA-6x88-8xw5-p2gw, OESA-2026-4063 and 3 more.