This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-52492 →

DEBIAN-CVE-2026-52492

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocat...

Original description

The description as published by the source.

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 tiff

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 tiff

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 tiff

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org