Analyst readout for executives and security teams
Plain-English summary
CVE-2026-4775 is a high-severity libtiff flaw. A malicious TIFF image can trigger memory corruption when opened or processed, potentially crashing the application or enabling code execution. Business risk is highest where Red Hat systems process untrusted image files, such as document intake, uploads, conversion services, or desktop workflows.
Executive priority
Treat as a priority patch for platforms that handle untrusted images. It is high severity with possible code execution, but exploitation requires a malicious file to be processed. Focus first on internet-facing upload pipelines, document workflows, and shared desktop environments using affected Red Hat packages.
Technical view
The flaw is a signed integer overflow in libtiff’s putcontig8bitYCbCr44tile function. Incorrect pointer calculations can cause an out-of-bounds heap write during TIFF processing. CVSS 3.1 is 7.8 with user interaction required and potential confidentiality, integrity, and availability impact.
Likely exposure
Confirmed affected packages in the source bundle are Red Hat libtiff, compat-libtiff3, and mingw-libtiff across listed RHEL 7 ELS, RHEL 8, RHEL 8.x lifecycle streams, and RHEL 10 variants. Exposure depends on whether systems or applications process TIFF files.
Exploitation context
Sources describe exploitation through a specially crafted TIFF file. The CVSS vector requires user interaction and local processing, so abuse likely depends on convincing a user or service to open or transform attacker-supplied TIFF content. No active exploitation is stated in the provided sources, and KEV is false.
Researcher notes
The public bundle identifies CWE-190 and an out-of-bounds heap write caused by signed integer overflow in putcontig8bitYCbCr44tile. Affected data is Red Hat-specific in the supplied sources. Do not assume other vendor impact or exploit availability without additional vendor confirmation.
Mitigation direction
- Apply the relevant Red Hat security errata for affected RHEL streams.
- Prioritize systems that process externally supplied TIFF or image files.
- Review vendor guidance for non-Red Hat libtiff builds or embedded copies.
- Limit or quarantine untrusted TIFF processing until updates are applied.
- Update container images and application bundles that include affected libtiff packages.
Validation and detection
- Inventory installed libtiff, compat-libtiff3, and mingw-libtiff package versions.
- Map hosts to the affected Red Hat product streams listed in the advisory data.
- Confirm applicable RHSA updates are installed through standard patch management evidence.
- Check containers and appliances for bundled libtiff packages.
- Verify image-processing applications restart or reload after package updates.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-4775 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 1.8 5.9 redhat Vulnerability scoring details
Base CVSS 3.1 score
7.8 HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timeline redhat
Reported to Red Hat.
- CVE reserved CVE Program
The CVE ID was reserved by the assigning CNA.
- Source timeline redhat
Made public.
- CVE published CVE Program
The CVE record was published.
- CVE updated CVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 source CVE List V5
- RHSA-2026:12265 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:12271 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:14929 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:16055 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:19150 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:19363 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:19585 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:19586 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:19604 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:19608 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:19609 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:19657 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:19659 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:19702 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:20583 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:20585 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:20591 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:20592 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:24992 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:25096 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:25910 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-4775 CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2450768 CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Overflow or Wraparound
Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.