Critical Security Update for compat-libtiff3: Addressing Arbitrary Code Execution Vulnerability
Summary
ALSA-2026:20585: Important: compat-libtiff3 security update. Affects compat-libtiff3 versions < 3.9.4-15.el8_10. Fixed in 3.9.4-15.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The compat-libtiff3 package provides an older version of the libtiff library, which is utilized for manipulating TIFF (Tagged Image File Format) image files. This package is primarily intended for users who cannot upgrade to the latest version of libtiff. The library is essential for applications that require TIFF file processing, making it a common dependency in various software environments. However, the older version has been found to contain security vulnerabilities that could be exploited if not addressed promptly.
Vulnerability Detail
The vulnerability identified as CVE-2026-4775 involves an arbitrary code execution or denial of service due to a signed integer overflow in the processing of TIFF files. This flaw allows attackers to craft malicious TIFF files that, when processed by applications using compat-libtiff3, could lead to unexpected behavior, including the execution of arbitrary code on the host system. The potential ramifications are severe, as they could compromise system integrity and confidentiality.
How To Fix
Minimum fixed version
3.9.4-15.el8_10
This is the first release that contains the fix.
sudo dnf update compat-libtiff3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider temporarily disabling the processing of TIFF files in applications that rely on compat-libtiff3 until the package can be updated. This can help mitigate the risk of exploitation while a permanent fix is being implemented.
Conclusion
The compat-libtiff3 package has a critical vulnerability that must be addressed to ensure the security of systems relying on it. Users are urged to update to the latest patched version to mitigate risks associated with arbitrary code execution. For ongoing monitoring of vulnerabilities, consider using Vulert's services.
See every vulnerability recorded for compat-libtiff3 →
FAQ
Compat-libtiff3 is a package that provides an older version of the libtiff library, which is used for handling TIFF image files.
CVE-2026-4775 is the identifier for a security vulnerability in compat-libtiff3 that allows for arbitrary code execution or denial of service due to a signed integer overflow.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could lead to unauthorized access, data breaches, and potential system compromise due to arbitrary code execution.
Yes, Vulert provides a service that monitors and alerts you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for compat-libtiff3.
