CVE-2026-18495: medium-severity vulnerability in Red Hat Ceph Storage 4
Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.1%
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Affected products
Red Hat · Red Hat Ceph Storage 4Red Hat · Red Hat Ceph Storage 6Red Hat · Red Hat Ceph Storage 7Red Hat · Red Hat Ceph Storage 8Red Hat · Red Hat Ceph Storage 9Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 6Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Hardened ImagesRelated CVEs — Red Hat Ceph Storage 4
In the same product, most dangerous first.
CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2025-32988MEDIUMGnutls: vulnerability in gnutls othername san exportEPSS 1.5%CVE-2025-32989MEDIUMGnutls: vulnerability in gnutls sct extension parsingEPSS 1.5%CVE-2025-4598MEDIUMSystemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dumpEPSS 1.3%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2025-32990MEDIUMGnutls: vulnerability in gnutls certtool template parsingEPSS 0.9%