--- id: CVE-2026-12912 title: A flaw was found in libtiff summary: >- A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR outp… severity: high cvss: 7.3 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-122 vendor: Red Hat product: libtiff affected: - libtiff (all versions) - libtiff (all versions) - compat-libtiff3 (all versions) - compat-libtiff3 (all versions) - libtiff (all versions) - compat-libtiff3 (all versions) - libtiff (all versions) - compat-libtiff3 (all versions) - libtiff (all versions) - compat-libtiff3 (all versions) - libtiff (all versions) - compat-libtiff3 (all versions) - libtiff (all versions) - compat-libtiff3 (all versions) - libtiff (all versions) - compat-libtiff3 (all versions) - libtiff (all versions) - libtiff (all versions) - libtiff (all versions) - libtiff (all versions) - libtiff (all versions) - libtiff-main (all versions) - libtiff - libtiff (all versions) - mingw-libtiff (all versions) - boost published: '2026-06-29' updated: '2026-09-21' sourceUpdated: '2026-09-21T13:17:07.827' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12912' references: - url: 'https://access.redhat.com/errata/RHSA-2026:34890' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:41892' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:42668' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:47183' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:47184' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:49671' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:50774' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54638' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54640' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54642' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:58545' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:58553' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:58554' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:58556' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:61657' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69292' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-12912' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2492871' label: secalert@redhat.com - url: 'https://gitlab.com/libtiff/libtiff/-/merge_requests/873' label: secalert@redhat.com - url: 'https://gitlab.com/libtiff/libtiff/-/work_items/824' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:34890' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:41892' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42668' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:47183' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:47184' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:49671' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:50774' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:54638' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:54640' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:54642' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:58545' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:58553' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:58554' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:58556' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:61657' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-12912' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2492871' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-12912' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12912' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-06-29T00:00:00+00:00' epss: 0.00433 epssPercentile: 0.37092 ingestedAt: '2026-07-03T13:02:28.094Z' patched: - enterprise_linux_server_v_7_els - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_aus_v_8_4 - enterprise_linux_appstream_eus_extension_v_8_4 - enterprise_linux_appstream_aus_v_8_6 - enterprise_linux_appstream_eus_extension_v_8_6 - enterprise_linux_appstream_e4s_v_8_8 - enterprise_linux_appstream_tus_v_8_8 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_codeready_linux_builder_eus_v_10_0 - enterprise_linux_codeready_linux_builder_v_10 - enterprise_linux_crb_v_8 - codeready_linux_builder_eus_v_9_6 - enterprise_linux_codeready_linux_builder_v_9 - hardened_images --- ## Overview A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS). ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:61657** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61657) - **RHSA-2026:49671** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49671) - **RHSA-2026:41892** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41892) - **RHSA-2026:47183** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:47183) - **RHSA-2026:47184** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:47184) - **RHSA-2026:54642** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54642) - **RHSA-2026:69292** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69292) - **RHSA-2026:54640** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54640) - **RHSA-2026:58545** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:58545) - **RHSA-2026:54638** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54638) - **RHSA-2026:58553** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:58553) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json)