A heap‑based buffer overflow exists in libtiff when decoding PixarLog‑compressed TIFF images that specify the PIXARLOGDATAFMT_8BITABGR output format and a particular stride value. The vulnerability can allow an attacker to overwrite memory on the heap, potentially leading to arbitrary code execution or a denial of service. The weakness is a classic buffer overflow as identified by CWE‑122.

The flaw affects multiple Red Hat distributions, including Red Hat Enterprise Linux 10, 6, 7, 8, and 9, as well as Red Hat Hardened Images that rely on the libtiff library. The issue is tied to the libtiff component within these platforms.

The CVSS score of 7.3 indicates a high severity, although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote: an adversary can supply a specially crafted TIFF image to any application that processes TIFF files with libtiff. The exploitation would require the application to decode a PixarLog‑compressed image using the vulnerable output format, which may be common in media or graphics processing tools.