A PixarLog-compressed TIFF overflows a libtiff heap buffer

Decoding a PixarLog image with the 8-bit ABGR output format and a specific stride leads to a heap-based buffer overflow.

Advisory

CVE-2026-12912 (also GHSA-cg4c-j43f-qcg7)

Library

libtiff, tiff on Debian

Published

2026-06-29

Severity

7.3 out of 10, as published

Affected

libtiff, as packaged; see the upstream record

Fixed in

see the upstream record

Reaches you

by opening a file

What triggers it

Opening a TIFF compressed with PixarLog.

What sillybos does

Refused by default

sillybos refuses the triggering file under its default policy, through the tiff_compressions check.

The compression scheme is a directory tag. The default policy allows none, CCITT, LZW, JPEG, Deflate and PackBits; PixarLog and the other codecs a scan never uses are refused by name.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

• tests/test_check.py::TestHostileFiles::test_a_pixarlog_tiff

How to protect yourself

In general. Keep libtiff current.

Specifically. Allow only the compression schemes your files use; sillybos --tiff-compressions.

The general advice applies to every row here.

Sources

• https://github.com/advisories/GHSA-cg4c-j43f-qcg7
• The record entry, triaged 2026-11-01, last checked 2026-11-01