CVE-2026-52490 Code injection in n/a
An attacker can execute arbitrary code via the process_command_opts function in libtiff, affecting systems using this image processing library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52490?
CVE-2026-52490 is a critical code injection vulnerability in n/a, published on 24 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c
Weakness: CWE-94
Which versions are affected by CVE-2026-52490?
Linux distribution packages (13)
libtiff AlmaLinux:8 | All versions | 4.0.9-39.el8_10 |
libtiff-devel AlmaLinux:8 | All versions | 4.0.9-39.el8_10 |
libtiff-tools AlmaLinux:8 | All versions | 4.0.9-39.el8_10 |
libtiff Red Hat:enterprise_linux:8::appstream | All versions | 0:4.0.9-39.el8_10 |
libtiff-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:4.0.9-39.el8_10 |
libtiff-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:4.0.9-39.el8_10 |
libtiff-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:4.0.9-39.el8_10 |
libtiff-tools-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:4.0.9-39.el8_10 |
libtiff-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:4.0.9-39.el8_10 |
libtiff-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:4.0.9-39.el8_10 |
libtiff-tools Red Hat:enterprise_linux:8::crb | All versions | 0:4.0.9-39.el8_10 |
libtiff-tools-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:4.0.9-39.el8_10 |
libtiff Rocky Linux:8 | All versions | 0:4.0.9-39.el8_10 |
How do I fix CVE-2026-52490?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-52490 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52490 exists.
Sources
Also known as ALSA-2026:69095, BELL-CVE-2026-52490, CLSA-2026-1792993665, CLSA-2026-1792993673, DEBIAN-CVE-2026-52490, ECHO-caa3-ac17-075f and 6 more.