The change-set you referred to is an attempt to solve a weakness in libtiff which has existed since libtiff was invented (and is common to libraries supporting compressed files).
There has recently been an overwhelming flurry of libtiff bug/security reports and a similarly large number of proposed change-sets. At least one change-set purports to solve the common reason for many security reports, which is integer value overflow. It is safest to assume that the next libtiff release will occur when it is ready. Bob On Wed, Jun 17, 2026, 10:29 AM Greg Troxel via Tiff <[email protected]> wrote: > I just got a forwarded copy of a note to oss-security@, at end. Reading > the linked issue, I know there were multiple issues with proposed > patches, and I'm very reluctant to take a patch from other than > upstream. > > I am wondering if there is a plan for 4.7.2, as reviewing commits looks > like mostly fixes and CI stuff. > > Alternatively, I wonder if anyone has identified the commits by sha1 > that should be cherry-picked, or if this is a theoretical DOS that isn't > worth worrying about. > > I am 10% of the way to understanding the merges, but only 10%. > > > > ---------------------------------------- > From: Ryo utomo <[email protected]> > Subject: [oss-security] [CVE-2026-36849] libtiff: Denial of Service via > large SamplesPerPixel tag > To: [email protected] > Date: Tue, 16 Jun 2026 17:13:49 -0700 (17 hours, 8 minutes, 21 seconds ago) > > Hi, > > I would like to disclose CVE-2026-36849, a denial of service vulnerability > in libtiff. > > == Summary == > > An issue in libtiff v4.7.1 allows an attacker to cause a denial of service > via a crafted TIFF file containing a large SamplesPerPixel tag value. > > == Affected Versions == > > libtiff v4.7.1 and prior > > == Patch == > > > https://gitlab.com/gitlab-org/build/omnibus-mirror/libtiff/-/commit/eedba405d3695b52faae65994c5904f228eca0bf > > == References == > > - CVE: CVE-2026-36849 > - Issue: https://gitlab.com/libtiff/libtiff/-/work_items/781 > > Regards, > Satriyo Utomo > (aleens-lab) > _______________________________________________ > Tiff mailing list > [email protected] > https://lists.osgeo.org/mailman/listinfo/tiff >
_______________________________________________ Tiff mailing list [email protected] https://lists.osgeo.org/mailman/listinfo/tiff
