RHSA-2026:58556: Important: libtiff security update
Important: libtiff security update
Other sources
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.Security Fix(es): libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libtiffto a version that resolves this vulnerability.Fixed in 4.4.0-12.el9_4.6 - Upgrade
Upgrade
redhat/libtiff-debuginfoto a version that resolves this vulnerability.Fixed in 4.4.0-12.el9_4.6 - Upgrade
Upgrade
redhat/libtiff-debugsourceto a version that resolves this vulnerability.Fixed in 4.4.0-12.el9_4.6 - Upgrade
Upgrade
redhat/libtiff-develto a version that resolves this vulnerability.Fixed in 4.4.0-12.el9_4.6 - Upgrade
Upgrade
redhat/libtiff-tools-debuginfoto a version that resolves this vulnerability.Fixed in 4.4.0-12.el9_4.6 - Upgrade
Upgrade
redhat/libtiffto a version that resolves this vulnerability.Fixed in 4.4.0-12.el9_4.6.aa - Upgrade
Upgrade
redhat/libtiff-debuginfoto a version that resolves this vulnerability.Fixed in 4.4.0-12.el9_4.6.aa - Upgrade
Upgrade
redhat/libtiff-debugsourceto a version that resolves this vulnerability.Fixed in 4.4.0-12.el9_4.6.aa - Upgrade
Upgrade
redhat/libtiff-develto a version that resolves this vulnerability.Fixed in 4.4.0-12.el9_4.6.aa - Upgrade
Upgrade
redhat/libtiff-tools-debuginfoto a version that resolves this vulnerability.Fixed in 4.4.0-12.el9_4.6.aa
Event History
Frequently Asked Questions
Which Red Hat product offerings are listed as affected?
The advisory lists Red Hat Enterprise Linux for x86_64 Extended Life Cycle and Update Services for SAP Solutions, ARM 64 4 years of updates and Extended Life Cycle, Server AUS, IBM z Systems Extended Life Cycle, and Power LE Extended Life Cycle and Update Services for SAP Solutions.
Does the available advisory data identify affected package versions, CVEs, or temporary mitigations?
No. The supplied data identifies this as a libtiff security update but does not provide package versions, CVE identifiers, exploitation prerequisites, default-configuration exposure, or mitigations.
When was this advisory published and last modified?
It was published on 2026-08-24 and was also last modified on 2026-08-24.