ZeroDay Findings
Sign inSign up

Findings

CVE-2026-12912

A flaw was found in libtiff.

Published Jun 29, 2026 · updated Oct 15, 2026

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 29, 2026 · NIST NVD

    Detected

    A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (D

  2. Oct 15, 2026 · NIST NVD

    Updated

    A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (D

Sources

  • CVE.orgVulnerability recordCVE-2026-12912

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-12912

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDVulnerability recordCVE-2026-12912

    A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, lead

    nvd.nist.gov

References