RHSA-2026:61657: Important: compat-libtiff3 security update
Important: compat-libtiff3 security update
Other sources
The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF (Tagged Image File Format) image format files. This version should be used only if you are unable to use the current version of libtiff.Security Fix(es): libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/compat-libtiff3to a version that resolves this vulnerability.Fixed in 3.9.4-12.el7_9.3 - Upgrade
Upgrade
redhat/compat-libtiff3-debuginfoto a version that resolves this vulnerability.Fixed in 3.9.4-12.el7_9.3
Event History
Frequently Asked Questions
Which systems are covered by this advisory?
The advisory applies to compat-libtiff3 and compat-libtiff3-debuginfo on Red Hat Enterprise Linux Server Extended Life Cycle Support, including the IBM z Systems and IBM Power big-endian variants.
What would an attacker need to exploit this issue?
An attacker would need to cause processing of a crafted TIFF image that uses PixarLog compression. The flaw is a heap-based buffer overflow in libtiff3.
How can I identify potentially affected installations?
Check whether the compat-libtiff3 package is installed on a covered Red Hat Enterprise Linux Server Extended Life Cycle Support system. Systems using this older libtiff 3 compatibility library are the relevant scope.