CVE-2026-12912 is a heap-based buffer overflow vulnerability in libtiff used by Red Hat Enterprise Linux 10. The issue arises during decoding of PixarLog codec images with the PIXARLOGDATAFMT_8BITABGR output format when a crafted stride value triggers an overflow. Exploitation requires a remote attacker to provide a specially crafted PixarLog-compressed TIFF image. The vulnerability can lead to arbitrary code execution or denial of service. The CVSS 3.1 base score is 7.3 (high severity) with attack vector local, low attack complexity, low privileges required, and user interaction needed. No official patch or remediation level is stated in the vendor advisory as of the provided data.

Successful exploitation may allow an attacker with local access and user interaction to execute arbitrary code or cause a denial of service on affected Red Hat Enterprise Linux 10 systems. The vulnerability impacts confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12912 for current remediation guidance. Until an official fix is available, avoid processing untrusted PixarLog-compressed TIFF images with the PIXARLOGDATAFMT_8BITABGR output format. Monitor Red Hat resources for updates.