Critical Integer Overflow Vulnerability in TIFF Package Could Lead to Remote Code Execution
Summary
ALPINE-CVE-2026-4775: A flaw was found in the libtiff library. Affects tiff versions < 4.7.2-r0. Fixed in 4.7.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TIFF (Tagged Image File Format) package is widely used for storing images and graphics. It supports various color spaces and is known for its flexibility and ability to handle high-quality images. However, the libtiff library, which is responsible for processing TIFF files, has been found to contain a significant vulnerability that could be exploited by attackers. This vulnerability arises from improper handling of input data, making it susceptible to crafted TIFF files that can lead to severe security issues.
Vulnerability Detail
A flaw was discovered in the libtiff library that allows a remote attacker to exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function. By providing a specially crafted TIFF file, an attacker can trigger an out-of-bounds heap write due to incorrect memory pointer calculations. This can result in a denial of service (application crash) or arbitrary code execution, posing a significant risk to systems using this library.
How To Fix
Minimum fixed version
4.7.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid opening untrusted TIFF files or implement strict input validation to mitigate the risk of exploitation until the package is updated.
Conclusion
The identified vulnerability in the TIFF package poses a significant risk due to its potential for remote code execution and application crashes. It is crucial for users to update to the patched version 4.7.2-r0 or later to safeguard their systems. Additionally, employing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for tiff →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to application crashes or arbitrary code execution, allowing attackers to gain control over affected systems.
Yes, avoid opening untrusted TIFF files and implement strict input validation as a temporary workaround.
More information about the TIFF package and its vulnerabilities can be found in the official Alpine Linux documentation and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
