Skip to content
Heist/ feed
HighFix available

DEBIAN-CVE-2026-4775

Type: advisorySource: OSV1 source record

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-4775

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-4775

tiff

Source reference: /affected/0/package/name

Affected versions
4.5.0-6

Source reference: /affected/0/versions

4.5.0-6+deb12u1

Source reference: /affected/0/versions

4.5.0-6+deb12u2

Source reference: /affected/0/versions

4.5.0-6+deb12u3

Source reference: /affected/0/versions

Fixed versions
4.5.0-6+deb12u4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

tiff

Source reference: /affected/1/package/name

Affected versions
4.7.0-3

Source reference: /affected/1/versions

4.7.0-3+deb13u1

Source reference: /affected/1/versions

Fixed versions
4.7.0-3+deb13u2

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

tiff

Source reference: /affected/2/package/name

Affected versions
4.7.0-3

Source reference: /affected/2/versions

4.7.0-4

Source reference: /affected/2/versions

4.7.0-5

Source reference: /affected/2/versions

4.7.1-1

Source reference: /affected/2/versions

Fixed versions
4.7.1-2

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.5.0-6+deb12u4"
          }
        ]
      }
    ],
    "package": {
      "name": "tiff",
      "purl": "pkg:deb/debian/tiff?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "4.5.0-6",
      "4.5.0-6+deb12u1",
      "4.5.0-6+deb12u2",
      "4.5.0-6+deb12u3"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4775.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.7.0-3+deb13u2"
          }
        ]
      }
    ],
    "package": {
      "name": "tiff",
      "purl": "pkg:deb/debian/tiff?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "4.7.0-3",
      "4.7.0-3+deb13u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4775.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.7.1-2"
          }
        ]
      }
    ],
    "package": {
      "name": "tiff",
      "purl": "pkg:deb/debian/tiff?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "4.7.0-3",
      "4.7.0-4",
      "4.7.0-5",
      "4.7.1-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4775.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]
Related CVEs
CVE-2026-4775

Source reference: /upstream

Publisher severity

high

Source reference: /severity/0/score

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-4775 · High

Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat AI Inference Server 3.2, Red Hat AI Inference Server 3.3, Red Hat AI Inference Server 3.3, Red Hat AI Inference Server 3.3, Red Hat AI Inference Server 3.3, Red Hat Hardened Images, Red Hat Hardened Images, Red Hat OpenShift AI 3.4, Red Hat Enterprise Linux 6

Event
#67687 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement