SECURITYCRITICALCVE-2026-52490

CVE-2026-52490: Critical Code Injection in libtiff tiffcrop

CVSS 9.8 code injection in libtiff's tiffcrop.c allows unauthenticated remote code execution. No patch confirmed; PoC published.

Dylan H.

Security Team

August 25, 2026
2 min read
CVE-2026-52490: Critical Code Injection in libtiff tiffcrop

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • libtiff (tiffcrop.c — commit 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938)

A critical code injection vulnerability has been disclosed in libtiff, the widely-used open-source TIFF image processing library. Tracked as CVE-2026-52490, the flaw carries a CVSS 3.1 score of 9.8 (Critical) and is exploitable remotely with no authentication and no user interaction required.

Vulnerability Details

FieldDetail
CVECVE-2026-52490
CVSS 3.19.8 Critical
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
TypeCode Injection (CWE-94)
Componentprocess_command_opts() in tools/tiffcrop.c
Affectedlibtiff (commit 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938)
Published2026-08-24
Updated2026-08-25

The vulnerability resides in the process_command_opts() function within tools/tiffcrop.c. A specially crafted TIFF file or malicious input can trigger arbitrary code injection, enabling an attacker to execute arbitrary code on the affected system.

Attack Surface

libtiff is a foundational library used across a vast range of software:

  • Linux distributions (virtually all mainstream distros package libtiff)
  • Graphics applications (ImageMagick, GIMP, LibreOffice, and many others link against it)
  • Server-side image processing pipelines and document handling systems
  • Embedded systems that process image files

Because the attack vector is network-accessible (AV:N) with no required privileges (PR:N) and no user interaction (UI:N), any service that processes user-supplied TIFF files and uses a vulnerable libtiff version is potentially exposed.

Proof of Concept

A PoC demonstrating the vulnerability has been published to a public GitHub Gist. A related issue has also been filed in the official libtiff GitLab repository. The public availability of a PoC increases the urgency of patching or mitigation.

Mitigation

As of the disclosure date, no official patch has been confirmed in the CVE record. Until a fix is available:

  • Restrict processing of untrusted TIFF files — avoid accepting user-supplied TIFF input in exposed services
  • Monitor for libtiff updates via your distribution's package tracker or the libtiff GitLab repository
  • Sandbox image processing: run TIFF processing in isolated containers or reduced-privilege environments where feasible
  • Consider input validation layers: strip or reject TIFF files from untrusted sources at the network perimeter

Check your exposure:

# Check installed libtiff version
dpkg -l libtiff5 2>/dev/null || rpm -q libtiff
 
# List processes linked to libtiff
lsof | grep libtiff

References