An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap… (CVE-2026-52492)

An integer overflow in the cvtRaster() function of the libtiff rgb2ycbcr utility leads to incorrect calculation of strip buffer sizes. This causes the heap allocation to be smaller than required, which can result in a heap-based buffer overflow when processing a crafted TIFF image during YCbCr color space conversion. The vulnerability is identified as CWE-190 (Integer Overflow or Wraparound) and has a CVSS 3.1 score of 7.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation details are provided in the available data.

Successful exploitation of this vulnerability can lead to a heap-based buffer overflow, which may allow an attacker to execute arbitrary code, cause a denial of service, or compromise system integrity when processing malicious TIFF images. The vulnerability affects the rgb2ycbcr utility within libtiff, impacting systems that use this utility for image processing.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or specially crafted TIFF images with the vulnerable rgb2ycbcr utility to reduce risk.