dbcve.org
Heap-based Buffer OverflowWeakness · CWE-122

CVE-2026-12912

HIGH · 7.3 CVSS v3.1 Published 2026-06-29
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
73/100
Remediation priority · Elevated
8 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A heap-based buffer overflow vulnerability exists in libtiff's Pixarlog codec decoder. The flaw is triggered when decoding PixarLog-compressed TIFF images using the PIXARLOGDATAFMT_8BITABGR output format with a specific stride value, allowing a remote attacker to cause out-of-bounds memory writes via a specially crafted image file.

MitigationUpdate libtiff to the latest patched version. Until a patch is available, avoid processing untrusted PixarLog-compressed TIFF images, especially those using the 8BITABGR format, or implement strict input validation on TIFF files before decoding.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed libtiff version
    Run 'tiffinfo -version' or 'tifftile -version' to display the libtiff version, or check the shared library file with 'ldd' on any TIFF utility and look for libtiff.so version, or query the package manager (dpkg -l libtiff*, rpm -q libtiff, brew list libtiff)
    Affected if The installed version is older than the patched version for CVE-2026-12912 and the library includes PixarLog support
  2. Confirm PixarLog decoder is available
    Run 'tiffinfo -h' or check libtiff configuration with 'tiffinfo -c' to see if PixarLog compression support is compiled into the library, or test with a known PixarLog-compressed TIFF if available
    Affected if The PixarLog codec is present and enabled in the build
  3. Detect code using PixarLog 8BITABGR format
    Search application source code or binaries for references to 'PIXARLOGDATAFMT_8BITABGR' or TIFFTAG_PIXARLOGDATAFMT with value 4, or use 'strings' on compiled binaries to find these identifiers
    Affected if Code explicitly sets the 8BITABGR output format when decoding PixarLog-compressed images
  4. Identify running processes handling untrusted TIFF files
    Use 'ps aux' and 'lsof' to find processes that have open .tif/.tiff files, or monitor with 'inotify-watch' or 'auditd' for TIFF file access in directories receiving untrusted input
    Affected if Applications are processing user-supplied or network-received TIFF files without validation
  5. Inspect libtiff for vulnerable decoder function
    Check the linked libtiff library version symbol with 'nm -D /path/to/libtiff.so | grep PixarLogDecode' or examine if the library was built with debug symbols to identify the PixarLogDecode function presence
    Affected if The PixarLogDecode function exists in the loaded library and handles compressed image data

You are affected if you run any version of libtiff that includes PixarLog support and process untrusted or crafted TIFF images using the 8BITABGR output format, as the heap overflow occurs during decoding with specific stride values.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Update libtiff to the latest patched version. Until a patch is available, avoid processing untrusted PixarLog-compressed TIFF images, especially those using the 8BITABGR format, or implement strict input validation on TIFF files before decoding.

Have this fixed Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-12912 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-12912 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data