CVE-2026-52490

Published: Aug 24, 2026Modified: Aug 25, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (3)

https://gist.github.com/okyfh/122c2d72e991a78c8af80a3af3be8671

Source: cve@mitre.org

https://gitlab.com/libtiff/libtiff/-/work_items/846

Source: cve@mitre.org

https://gitlab.com/libtiff/libtiff/-/work_items/846

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.