Security · libtiff

tiff2ps dereferences a null pointer in PS_Lvl2page

A vulnerability classified as problematic was found in libtiff 4.6.0.

What triggers it

Running the tiff2ps command-line tool on a crafted TIFF.

Not reached by opening a file

Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.

In tools/tiff2ps.c, a command-line tool; no library call opening a file runs it.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.

In general. Upgrade libtiff to a version that has the fix; the upstream record names it.

Specifically. Not a pre-decode matter: a command-line tool, not the library, runs the flawed code.

The general advice applies to every row here.