Bug 2450768 (CVE-2026-4775) - CVE-2026-4775 libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing
Summary: CVE-2026-4775 libtiff: libtiff: Arbitrary code execution or denial of service...
Keywords:
Status: NEW
Alias: CVE-2026-4775
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2450769 2450770 2450772 2450773 2450771
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-24 14:34 UTC by OSIDB Bzimport
Modified: 2026-07-28 09:15 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2026:12429 0 None None None 2026-04-30 17:31:07 UTC
Red Hat Product Errata RHBA-2026:16232 0 None None None 2026-05-12 12:58:58 UTC
Red Hat Product Errata RHBA-2026:20544 0 None None None 2026-05-26 01:30:19 UTC
Red Hat Product Errata RHSA-2026:12265 0 None None None 2026-04-30 12:19:45 UTC
Red Hat Product Errata RHSA-2026:12271 0 None None None 2026-04-30 14:13:09 UTC
Red Hat Product Errata RHSA-2026:14929 0 None None None 2026-05-07 20:58:37 UTC
Red Hat Product Errata RHSA-2026:16055 0 None None None 2026-05-11 20:37:21 UTC
Red Hat Product Errata RHSA-2026:19150 0 None None None 2026-05-19 16:09:52 UTC
Red Hat Product Errata RHSA-2026:19363 0 None None None 2026-05-19 21:40:38 UTC
Red Hat Product Errata RHSA-2026:19585 0 None None None 2026-05-20 11:43:38 UTC
Red Hat Product Errata RHSA-2026:19586 0 None None None 2026-05-20 11:21:32 UTC
Red Hat Product Errata RHSA-2026:19604 0 None None None 2026-05-20 12:05:46 UTC
Red Hat Product Errata RHSA-2026:19608 0 None None None 2026-05-20 12:06:52 UTC
Red Hat Product Errata RHSA-2026:19609 0 None None None 2026-05-20 12:11:02 UTC
Red Hat Product Errata RHSA-2026:19657 0 None None None 2026-05-20 13:24:19 UTC
Red Hat Product Errata RHSA-2026:19659 0 None None None 2026-05-20 13:18:20 UTC
Red Hat Product Errata RHSA-2026:19702 0 None None None 2026-05-20 14:04:08 UTC
Red Hat Product Errata RHSA-2026:20583 0 None None None 2026-05-26 03:52:20 UTC
Red Hat Product Errata RHSA-2026:20585 0 None None None 2026-05-26 04:47:29 UTC
Red Hat Product Errata RHSA-2026:20591 0 None None None 2026-05-26 04:36:11 UTC
Red Hat Product Errata RHSA-2026:20592 0 None None None 2026-05-26 04:42:19 UTC
Red Hat Product Errata RHSA-2026:24992 0 None None None 2026-06-10 07:44:08 UTC
Red Hat Product Errata RHSA-2026:25910 0 None None None 2026-06-15 01:56:17 UTC

Description OSIDB Bzimport 2026-03-24 14:34:15 UTC 
A flaw was found in the libtiff library. A signed integer overflow exists in the putcontig8bitYCbCr44tile function (and potentially similar functions like putcontig8bitYCbCr42tile, putcontig8bitYCbCr22tile, and putcontig8bitYCbCr12tile) within tif_getimage.c. When processing a specially crafted TIFF file with an extremely large width and specific YCbCr subsampling, the calculation for the pointer progression variable (incr) can overflow the 32-bit signed integer boundary. This results in an incorrect negative progression of memory pointers, leading to an out-of-bounds heap write. An attacker could exploit this to cause a denial of service (application crash) or potentially execute arbitrary code.
Comment 2 errata-xmlrpc 2026-04-30 12:19:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:12265 https://access.redhat.com/errata/RHSA-2026:12265
Comment 3 errata-xmlrpc 2026-04-30 14:13:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:12271 https://access.redhat.com/errata/RHSA-2026:12271
Comment 4 errata-xmlrpc 2026-05-07 20:58:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:14929 https://access.redhat.com/errata/RHSA-2026:14929
Comment 5 errata-xmlrpc 2026-05-11 20:37:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:16055 https://access.redhat.com/errata/RHSA-2026:16055
Comment 6 errata-xmlrpc 2026-05-19 16:09:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19150 https://access.redhat.com/errata/RHSA-2026:19150
Comment 7 errata-xmlrpc 2026-05-19 21:40:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19363 https://access.redhat.com/errata/RHSA-2026:19363
Comment 8 errata-xmlrpc 2026-05-20 11:21:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:19586 https://access.redhat.com/errata/RHSA-2026:19586
Comment 9 errata-xmlrpc 2026-05-20 11:43:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:19585 https://access.redhat.com/errata/RHSA-2026:19585
Comment 10 errata-xmlrpc 2026-05-20 12:05:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:19604 https://access.redhat.com/errata/RHSA-2026:19604
Comment 11 errata-xmlrpc 2026-05-20 12:06:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:19608 https://access.redhat.com/errata/RHSA-2026:19608
Comment 12 errata-xmlrpc 2026-05-20 12:11:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:19609 https://access.redhat.com/errata/RHSA-2026:19609
Comment 13 errata-xmlrpc 2026-05-20 13:18:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:19659 https://access.redhat.com/errata/RHSA-2026:19659
Comment 14 errata-xmlrpc 2026-05-20 13:24:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:19657 https://access.redhat.com/errata/RHSA-2026:19657
Comment 15 errata-xmlrpc 2026-05-20 14:04:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:19702 https://access.redhat.com/errata/RHSA-2026:19702
Comment 16 errata-xmlrpc 2026-05-26 03:52:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:20583 https://access.redhat.com/errata/RHSA-2026:20583
Comment 17 errata-xmlrpc 2026-05-26 04:36:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:20591 https://access.redhat.com/errata/RHSA-2026:20591
Comment 18 errata-xmlrpc 2026-05-26 04:42:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:20592 https://access.redhat.com/errata/RHSA-2026:20592
Comment 19 errata-xmlrpc 2026-05-26 04:47:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:20585 https://access.redhat.com/errata/RHSA-2026:20585
Comment 20 errata-xmlrpc 2026-06-10 07:44:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:24992 https://access.redhat.com/errata/RHSA-2026:24992
Comment 21 errata-xmlrpc 2026-06-15 01:56:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:25910 https://access.redhat.com/errata/RHSA-2026:25910
Note You need to log in before you can comment on or make changes to this bug.