RHSA-2026:58545: Important: libtiff security update

Q: What input is required to trigger the vulnerability?

An attacker needs to provide a crafted TIFF image that uses PixarLog compression. The flaw is a heap-based buffer overflow in libtiff's handling of that image type.

Q: Which deployed components should be reviewed for exposure?

Review systems using the Red Hat libtiff package, particularly deployments of Red Hat Enterprise Linux for x86_64 Extended Life Cycle Long Life or Red Hat Enterprise Linux Server AUS. The advisory also lists libtiff development, debug, debuginfo, and tools-debuginfo packages.

Q: How can I identify potentially vulnerable systems?

Identify installed libtiff packages on the affected Red Hat Enterprise Linux offerings and determine whether applications on those systems process TIFF files, especially PixarLog-compressed images. The provided data does not include fixed package versions or additional configuration-based detection criteria.

Published Aug 24, 2026

Updated

Important: libtiff security update

Other sources

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.Security Fix(es): libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat

Affected Software

12 affected componentsFixes available

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life

Red Hat Red Hat Enterprise Linux Server - AUS

redhat/libtiff<4.0.9-21.el8_6.3

4.0.9-21.el8_6.3

redhat/libtiff<4.0.9-21.el8_6.3

4.0.9-21.el8_6.3

redhat/libtiff-debuginfo<4.0.9-21.el8_6.3

4.0.9-21.el8_6.3

redhat/libtiff-debuginfo<4.0.9-21.el8_6.3

4.0.9-21.el8_6.3

redhat/libtiff-debugsource<4.0.9-21.el8_6.3

4.0.9-21.el8_6.3

redhat/libtiff-debugsource<4.0.9-21.el8_6.3

4.0.9-21.el8_6.3

redhat/libtiff-devel<4.0.9-21.el8_6.3

4.0.9-21.el8_6.3

redhat/libtiff-devel<4.0.9-21.el8_6.3

4.0.9-21.el8_6.3

redhat/libtiff-tools-debuginfo<4.0.9-21.el8_6.3

4.0.9-21.el8_6.3

redhat/libtiff-tools-debuginfo<4.0.9-21.el8_6.3

4.0.9-21.el8_6.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/libtiff to a version that resolves this vulnerability.
Fixed in 4.0.9-21.el8_6.3
Upgrade
Upgrade redhat/libtiff-debuginfo to a version that resolves this vulnerability.
Fixed in 4.0.9-21.el8_6.3
Upgrade
Upgrade redhat/libtiff-debugsource to a version that resolves this vulnerability.
Fixed in 4.0.9-21.el8_6.3
Upgrade
Upgrade redhat/libtiff-devel to a version that resolves this vulnerability.
Fixed in 4.0.9-21.el8_6.3
Upgrade
Upgrade redhat/libtiff-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 4.0.9-21.el8_6.3

Event History

Aug 24, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·12:55 AM

Data Sourced

via Red Hat·12:55 AM

Severity

Frequently Asked Questions

What input is required to trigger the vulnerability?

An attacker needs to provide a crafted TIFF image that uses PixarLog compression. The flaw is a heap-based buffer overflow in libtiff's handling of that image type.

Which deployed components should be reviewed for exposure?

Review systems using the Red Hat libtiff package, particularly deployments of Red Hat Enterprise Linux for x86_64 Extended Life Cycle Long Life or Red Hat Enterprise Linux Server AUS. The advisory also lists libtiff development, debug, debuginfo, and tools-debuginfo packages.

How can I identify potentially vulnerable systems?

Identify installed libtiff packages on the affected Red Hat Enterprise Linux offerings and determine whether applications on those systems process TIFF files, especially PixarLog-compressed images. The provided data does not include fixed package versions or additional configuration-based detection criteria.

RHSA-2026:58545: Important: libtiff security update

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What input is required to trigger the vulnerability?

Which deployed components should be reviewed for exposure?

How can I identify potentially vulnerable systems?

Company

Resources

Contact

Frequently Asked Questions

What input is required to trigger the vulnerability?

Which deployed components should be reviewed for exposure?

How can I identify potentially vulnerable systems?