CVE-2026-18495 is a heap-buffer overflow vulnerability in the tiff2pdf utility of libtiff caused by an integer truncation error when handling crafted BigTIFF files. The 64-bit StripByteCounts value is truncated to 32 bits, causing an undersized buffer allocation and subsequent out-of-bounds memory copy. This leads to potential denial of service via crash and memory corruption. Exploitation requires local privileges and user interaction. Red Hat has issued a security advisory and released updated libtiff packages (version 4.7.2-2.hum1) to fix the flaw.

The vulnerability can cause denial of service through application crashes and severe memory corruption when processing malicious BigTIFF files. While the CVSS score is medium (6.1), the flaw could potentially be leveraged for more severe impacts such as arbitrary code execution due to heap overflow, though this is not explicitly confirmed. Exploitation requires local access and user interaction, limiting remote attack vectors.

Red Hat has released an official security update fixing this vulnerability in libtiff version 4.7.2-2.hum1 for affected Red Hat Hardened Images. Users should apply this update promptly to mitigate the risk. No additional mitigations are specified or required beyond applying the official patch.