RHSA-2026:53467HighCVSS 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
August 11, 2026
Last Modified
September 16, 2026

🔗 CVE IDs covered (4)

CVE-2026-52490 →CVE-2026-52491 →CVE-2026-52492 →CVE-2026-18495 →

📋 Description

CVE-2026-18495 — libtiff: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough CVE-2026-52490 — libtiff: libtiff: Arbitrary code execution via process_command_opts() function CVE-2026-52491 — libtiff: libtiff: Arbitrary code execution via thumbnail.c: main() component CVE-2026-52492 — libtiff: libtiff: Arbitrary code execution via crafted TIFF image

🎯 Affected products4

  • Red Hat Hardened Images
  • libtiff-main@aarch64 as a component of Red Hat Hardened Images
  • libtiff-main@src as a component of Red Hat Hardened Images
  • libtiff-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Avoid using the `tiffcrop` utility to process TIFF image files from untrusted sources. If the `libtiff-tools` package, which provides `tiffcrop`, is not required, consider removing it to prevent exploitation. Workaround: To mitigate this issue, avoid processing untrusted or maliciously crafted TIFF images with the rgb2ycbcr utility. Users should exercise caution when handling TIFF files from unknown or suspicious sources.

🔗 References (8)