CVE-2026-18495
Published: September 11th, 2026
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.
MEDIUM
CVSS v3: 6.1
CVSS v3: 6.1
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| daily | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 26.3 | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 26.2 | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 26.1 | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 25.4 | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 25.3 | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 25.2 | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 25.1 | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 24.4 | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 24.4.0 | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 24.3 | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 24.2 | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 24.1 | libtiff (4.6.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 23.3 | libtiff (4.5.1) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 23.2 | libtiff (4.3.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 23.1 | libtiff (4.3.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 22.4 | libtiff (4.3.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 22.3 | libtiff (4.3.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 22.2 | libtiff (4.3.0) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 22.1 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 21.11 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 21.8 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 21.5.0 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 21.2.0 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 11.4.19.3667 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 11.4.18.3599 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 11.4.16.3445 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 11.4.15.3368 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 11.4.14.3263 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 11.4.13.3179 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 11.4.12.3054 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 11.4.11.3040 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 11.4.11.2990 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 11.4.10.2934 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 11.4.9.2878 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
| 11.4.8.2822 | libtiff (4.0.8) | Not Affected | Code Not Present | CVE-2026-18495 is a heap-buffer overflow in libtiff’s standalone tiff2pdf command-line utility (upstream tools/tiff2pdf.c, the t2p_* code), caused by a 64-bit StripByteCounts value being truncated to 32 bits when converting a crafted BigTIFF; it was fixed upstream in v4.7.1rc1 (commit 67fd283d276f09db54dc39b9ef7b979d4b45c4b1). Document Filters vendors only the core libtiff library: external/libtiff-4.6.0/ contains the tif_.c sources with no tools/ directory, no tiff2pdf.c, and no t2p_ symbols anywhere in the repository (the only ‘tiff2pdf’ matches are inside an archived doc/test rename hunk in df-patches/). external/libtiff.cmake lists only the core tif_*.c files, so tiff2pdf is neither present nor compiled. Although our version 4.6.0 falls within the vulnerable range (< 4.7.1), the vulnerable component does not exist in our copy and cannot be reached. |
Severity score breakdown
Attack Complexity
LOW
Attack Vector
LOCAL
Availability Impact
HIGH
Base Score
6.1
Base Severity
MEDIUM
Confidentiality Impact
LOW
Integrity Impact
LOW
Privileges Required
LOW
Scope
UNCHANGED
User Interaction
REQUIRED
Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Version
3.1