Loading story…
Red Hat released Important security updates for libtiff to address CVE-2026-12912, a heap-based buffer overflow that can be triggered by a crafted PixarLog-compressed TIFF image. The flaw occurs when decoding images with PIXARLOGDATAFMT_8BITABGR and a stride of 3: horizontalAccumulate8abgr expands 3-byte input triplets into 4-byte output pixels, while PixarLogDecode advances the output pointer by only 3 bytes. Because TIFFScanlineSize can also return an undersized buffer for this configuration, applications that allocate buffers according to documented guidance may write past the end of the heap buffer by roughly one image-width byte per scan line.
The issue affects applications that explicitly select the vulnerable output format and read PixarLog-compressed TIFF files with SamplesPerPixel=3, while TIFFReadRGBAImage is not directly affected. Red Hat said the bug has been addressed across multiple supported product streams, including RHEL 9.4, RHEL 9.2, and RHEL 8.6 support channels, with updated packages such as libtiff-4.4.0-12.el9_4.6, libtiff-4.4.0-8.el9_2.6, and libtiff-4.0.9-21.el8_6.3 released for affected architectures and variants including SAP, AUS, EUS, and Extended Life Cycle offerings.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat published the Important RHSA-2026:61657 security advisory for affected RHEL 7 systems using compat-libtiff3, addressing CVE-2026-12912. The advisory remediates the heap-based buffer overflow triggered by crafted PixarLog-compressed TIFF images.
Red Hat published RHSA-2026:58556, an Important libtiff security advisory for Red Hat Enterprise Linux 9.4 update channels including SAP Solutions, AUS, and Extended Life Cycle variants, to remediate CVE-2026-12912. The advisory released libtiff 4.4.0-12.el9_4.6 packages for x86_64, aarch64, ppc64le, and s390x.
Red Hat published RHSA-2026:58554, an Important libtiff security advisory for Red Hat Enterprise Linux 9.2 SAP, AUS, and Extended Life Cycle offerings, addressing CVE-2026-12912. Updated libtiff 4.4.0-8.el9_2.6 packages were released across multiple architectures and product variants.
Red Hat published RHSA-2026:58545, an Important libtiff security advisory for Red Hat Enterprise Linux 8.6 support channels, to fix CVE-2026-12912. The update released libtiff 4.0.9-21.el8_6.3 packages for affected x86_64 and i686 package sets.
Red Hat published RHSA-2026:58553, an Important libtiff security advisory for Red Hat Enterprise Linux 8.8 update channels including Extended Life Cycle Long Life, Telecommunications Update Service, and Update Services for SAP Solutions, addressing CVE-2026-12912. The advisory released libtiff 4.0.9-29.el8_8.3 packages across supported x86_64, i686, and ppc64le variants.
Red Hat documented CVE-2026-12912 in Bugzilla entry 2492871 as a heap-based buffer overflow in libtiff when decoding crafted PixarLog-compressed TIFF images with the PIXARLOGDATAFMT_8BITABGR output format. The report described the pointer-advance mismatch, undersized TIFFScanlineSize result, and proof-of-concept-triggered heap overflow.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat issued Moderate-severity advisories for **CVE-2023-52356**, a `libtiff` flaw in `TIFFReadRGBATileExt()` that can trigger a segmentation fault and denial of service when a system processes a crafted TIFF file. Fixed packages include `libtiff-4.4.0-13.el9_6.3` for supported RHEL 9.6 channels, `libtiff-4.4.0-15.el9` for supported RHEL 9 releases, and `libtiff-4.6.0-6.el10_0.2` and `libtiff-4.6.0-6.el10_1.2` for RHEL 10.0 and 10.1 channels, respectively, across x86_64, aarch64, ppc64le, and s390x. The remediation also follows earlier RHEL 8 container-image updates for Middleware, CUPS, and Camel K Operator deployments, which incorporated fixes for `CVE-2023-52356` alongside libtiff heap-overflow issues `CVE-2018-15209`, `CVE-2023-25433`, and `CVE-2023-6228`. Organizations should apply the relevant RHEL updates and, for affected OpenShift and RHEL 8 container environments, pull revised base images and rebuild dependent images to ensure vulnerable libtiff components are replaced.
Aug 26, 2026
Red Hat released **RHSA-2024:5079** for Red Hat Enterprise Linux 8 and RHEL 8.10 Extended Life Cycle, updating `libtiff` to remediate four crafted-TIFF vulnerabilities: `CVE-2018-15209`, `CVE-2023-25433`, `CVE-2023-6228`, and `CVE-2023-52356`. The updated packages are available for x86_64, s390x, ppc64le, and aarch64; related tools packages are provided through CodeReady Linux Builder. The flaws are heap-based buffer overflows in libtiff APIs and utilities, including `tiff2pdf`, `tiffcp`, and `tiffcrop`. Processing a malicious TIFF can crash affected programs and cause denial of service; `CVE-2023-25433` stems from incorrect buffer-size updating after `rotateImage()` in `tiffcrop`. Red Hat assessed the issues primarily as requiring crafted-file processing and rated the advisory Moderate, while support and remediation status varies across RHEL releases and the `compat-libtiff3` package.
Aug 26, 2026
Red Hat released **Important** libarchive security updates for affected RHEL 7 ELS, RHEL 8, and RHEL 9 releases and subscription channels, including OpenShift Container Platform and RHEL-based middleware containers. The updates remediate `CVE-2026-4424`, a heap out-of-bounds read in RAR processing: a crafted archive can exploit an LZSS dictionary-size validation error after PPMd-to-LZSS transitions to expose heap memory through `archive_read_data()` before CRC validation. Systems that automatically process untrusted archives may be remotely triggerable without authentication or user interaction. The releases also fix `CVE-2026-5121`, an ISO9660 zisofs parsing integer overflow that can allocate an undersized buffer and copy attacker-controlled data beyond its bounds. The resulting heap overflow can potentially enable arbitrary code execution on **32-bit** targets, subject to allocator- and platform-specific heap grooming; 64-bit systems do not exhibit the same integer wraparound. Organizations should update libarchive and associated `bsdtar`, `bsdcat`, and `bsdcpio` packages using the applicable Red Hat advisory—for example, RHEL 9 packages `3.5.3-9.el9_7`, RHEL 8 packages `3.3.3-7.el8_10`, and RHEL 7 ELS packages `3.1.2-14.el7_9.2`—or later supported versions.
Aug 25, 2026