A critical code injection vulnerability has been disclosed in libtiff, the widely-used open-source TIFF image processing library. Tracked as CVE-2026-52490, the flaw carries a CVSS 3.1 score of 9.8 (Critical) and is exploitable remotely with no authentication and no user interaction required.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE | CVE-2026-52490 |
| CVSS 3.1 | 9.8 Critical |
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Type | Code Injection (CWE-94) |
| Component | process_command_opts() in tools/tiffcrop.c |
| Affected | libtiff (commit 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938) |
| Published | 2026-08-24 |
| Updated | 2026-08-25 |
The vulnerability resides in the process_command_opts() function within tools/tiffcrop.c. A specially crafted TIFF file or malicious input can trigger arbitrary code injection, enabling an attacker to execute arbitrary code on the affected system.
Attack Surface
libtiff is a foundational library used across a vast range of software:
- Linux distributions (virtually all mainstream distros package libtiff)
- Graphics applications (ImageMagick, GIMP, LibreOffice, and many others link against it)
- Server-side image processing pipelines and document handling systems
- Embedded systems that process image files
Because the attack vector is network-accessible (AV:N) with no required privileges (PR:N) and no user interaction (UI:N), any service that processes user-supplied TIFF files and uses a vulnerable libtiff version is potentially exposed.
Proof of Concept
A PoC demonstrating the vulnerability has been published to a public GitHub Gist. A related issue has also been filed in the official libtiff GitLab repository. The public availability of a PoC increases the urgency of patching or mitigation.
Mitigation
As of the disclosure date, no official patch has been confirmed in the CVE record. Until a fix is available:
- Restrict processing of untrusted TIFF files — avoid accepting user-supplied TIFF input in exposed services
- Monitor for libtiff updates via your distribution's package tracker or the libtiff GitLab repository
- Sandbox image processing: run TIFF processing in isolated containers or reduced-privilege environments where feasible
- Consider input validation layers: strip or reject TIFF files from untrusted sources at the network perimeter
Check your exposure:
# Check installed libtiff version
dpkg -l libtiff5 2>/dev/null || rpm -q libtiff
# List processes linked to libtiff
lsof | grep libtiff