DEBIAN-CVE-2026-18495
Dashboard / Vulnerabilities / DEBIAN-CVE-2026-18495
Summary:
Details: A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.
Affected packages
Package
Name: tiff
Purl: pkg:deb/debian/tiff?arch=source&distro=bookworm
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
4.5.0-6
4.5.0-6+deb12u1
4.5.0-6+deb12u2
4.5.0-6+deb12u3
4.5.0-6+deb12u4
4.5.1+git230720-1
4.5.1+git230720-2
4.5.1+git230720-3
4.5.1+git230720-4
4.5.1+git230720-5
4.5.1-1
4.5.1~rc3-1
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
