A signed integer overflow vulnerability (CVE-2026-4775) in the mingw-libtiff library allows for arbitrary code execution or denial of service via specially crafted TIFF files. The advisory is rated Important, though a specific CVSS score is not provided in the excerpt. The update fixes the flaw in Red Hat Enterprise Linux 8's mingw-libtiff packages, with the patched version being 4.0.9-4.el8_10.
Red Hat Product Errata RHSA-2026:14929 - Security Advisory Issued: 2026-05-07 Updated: 2026-05-07 RHSA-2026:14929 - Security Advisory Overview Updated Packages Synopsis Important: mingw-libtiff security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for mingw-libtiff is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The libtiff package contains a library of functions for manipulating TIFF (Tagged Image File Format) image format files. TIFF is a widely used file format for bitmapped images. TIFF files usually end in the .tif extension and they are often quite large. The libtiff package should be installed if you need to manipulate TIFF format image files. Security Fix(es): libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat CodeReady Linux Builder for x86_64 8 x86_64 Fixes BZ - 2450768 - CVE-2026-4775 libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing CVEs CVE-2026-4775 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat CodeReady Linux Builder for x86_64 8 SRPM mingw-libtiff-4.0.9-4.el8_10.src.rpm SHA-256: 0d32ab517c9d59e1aaef7bbbd9d998c235e980a2dd4c415de8cb7c63191dc629 x86_64 mingw32-libtiff-4.0.9-4.el8_10.noarch.rpm SHA-256: 23e0ca55cacaaca7e49a1758e3e12cc5dfff518e0a24e9c9713724b5712e4ce0 mingw32-libtiff-debuginfo-4.0.9-4.el8_10.noarch.rpm SHA-256: c246cbb19cb9a13f4d54d2c675e0e0cf1aba7319b48cda5da3c142d96c52fcf9 mingw32-libtiff-static-4.0.9-4.el8_10.noarch.rpm SHA-256: 933b8f03ee134fceaf74a9e26d68f63c0970be6e06dd1b5263e60d36f7ab606e mingw64-libtiff-4.0.9-4.el8_10.noarch.rpm SHA-256: a7164fef318a4f6622fdc8ec55cd488d36773af2c309f5db618716dfe7a55296 mingw64-libtiff-debuginfo-4.0.9-4.el8_10.noarch.rpm SHA-256: e11e50df258ca9e611a50fefad9a5f1359365b2a52d21caeb79af939c3be301b mingw64-libtiff-static-4.0.9-4.el8_10.noarch.rpm SHA-256: 3e75ed7dc73a425a14237dfd5366a13be4a0e367d6531234031453cbf95b17c3 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .