CVE-2026-4775

Name
CVE-2026-4775
Description
A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
secalert@redhat.com https://access.redhat.com/security/cve/CVE-2026-4775
secalert@redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2450768
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:12265
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:12271
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:14929
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:16055
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:19150
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:19363
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:19585
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:19586
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:19608
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:19609
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:19657
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:19604
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:19659
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:19702
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:20583
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:20585
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:20591
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:20592
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:24992
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:25096
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:25910
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:30078
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:30087
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:30088
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:30089
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:30349
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:33388
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74674

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:libtiff:libtiff:-:*:*:*:*:*:*:* libtiff == None == -
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:* hardened_images == None == -
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* debian_linux == None == 11.0
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* enterprise_linux == None == 6.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* enterprise_linux == None == 7.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* enterprise_linux == None == 8.0
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* enterprise_linux == None == 9.0
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* enterprise_linux == None == 10.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
tiff 3.24-main 4.7.2-r0 Michael Mason <ms13sp@gmail.com> fixed
tiff 3.23-main 4.7.2-r0 Michael Mason <ms13sp@gmail.com> fixed
tiff 3.22-main 4.7.2-r0 Michael Mason <ms13sp@gmail.com> fixed
tiff 3.21-main 4.7.2-r0 Michael Mason <ms13sp@gmail.com> fixed
qt6-qtwebengine edge-community 6.11.0-r9 Bart Ribbers <bribbers@disroot.org> fixed
qt6-qtwebengine 3.23-community 6.10.3-r3 Bart Ribbers <bribbers@disroot.org> fixed