CVE-2026-52492: n/a

An integer overflow in libtiff's rgb2ycbcr utility cvtRaster() function causes incorrect calculation of strip buffer sizes. This leads to an undersized heap allocation, which can be exploited to cause a heap-based buffer overflow during YCbCr color space conversion of a maliciously crafted TIFF image. The vulnerability is identified as CWE-190 and has a CVSS 3.1 base score of 7.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation information is currently available.

Successful exploitation of this vulnerability can result in a heap-based buffer overflow, potentially allowing an attacker to execute arbitrary code, cause a denial of service, or compromise system integrity when processing a crafted TIFF image. The CVSS vector indicates local attack vector with low complexity, no privileges required, and user interaction required, affecting confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted TIFF images with the vulnerable libtiff rgb2ycbcr utility to reduce risk.