CVEvulnerability

CVE-2026-18495

6.1 MEDIUM Published 2026-09-11 Modified 2026-10-07 Official page ↗
Status
Awaiting Analysis
Published
2026-09-11
Last modified
2026-10-07
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Weaknesses
CWE-122

Description

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Related

Weakness · CWE (1)

  • CWE-122 Heap-based Buffer Overflow weakness

References