CVE-2026-46599: TIFF PackBits Decoder Denial of Service Vulnerability

Technical summary

The vulnerability stems from missing input validation in TIFF decoder implementations that process PackBits-compressed segments. PackBits is a simple run-length encoding scheme; without decompression limits, a small number of compressed bytes can expand to arbitrarily large output. An attacker crafts a TIFF file where the image dimensions (width/height) and file size suggest a benign payload, but the PackBits data streams contain compression ratios that cause memory and CPU exhaustion during decompression. The flaw is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), a pattern weakness that enables algorithmic complexity attacks and resource-based denial of service.

Business impact

Organizations relying on automated image processing pipelines—such as document management systems, web thumbnail generators, email attachment handlers, or cloud storage services—face availability risks. A single malicious TIFF uploaded by an attacker could trigger decoder crashes, service hangs, or memory exhaustion on backend servers. For businesses processing user-generated or untrusted content, this translates to potential service interruptions, support overhead, and reputational damage if malicious images cause user-facing outages.

Affected systems

Any application or library that decodes TIFF images using PackBits decompression is potentially affected. This includes image viewers, graphics libraries, document converters, content management systems, and cloud services that handle TIFF uploads. The vulnerability is not tied to specific vendor products in the ground-truth data, indicating either broad cross-vendor impact or that vendor-specific information is pending. Organizations should inventory their use of TIFF decoding—both in first-party code and embedded libraries—to assess exposure.

Exploitability

Exploitability is high and requires only network access; no authentication, user interaction, or privilege escalation is needed (CVSS vector AV:N/AC:L/PR:N/UI:N). An attacker simply uploads or delivers a malicious TIFF file to a target system. The attack surface is particularly wide in environments that accept file uploads, process attachments automatically, or scan content from external sources. Proof-of-concept is straightforward: craft a TIFF with legitimate headers but engineered PackBits data that decompresses to gigabytes of output. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but that does not diminish the practical risk given the simplicity of weaponization.

Remediation

Immediate mitigation includes implementing decompression limits in TIFF decoder configurations—capping output buffer sizes and absolute decompressed data volumes per image. Rate-limiting or timeout controls on image processing operations can reduce the impact of resource exhaustion. Long-term remediation requires patching underlying TIFF libraries or upgrading to vendor releases that validate PackBits segment sizes and enforce memory boundaries. Organizations should verify patch availability from their image library or application vendor and prioritize deployment based on exposure (e.g., public-facing image services first).

Patch guidance

Consult your TIFF decoder vendor or embedded library provider for patched versions. Since affected products are not specified in CVE details, review your software bill of materials (SBOM) and identify which libraries handle TIFF decoding. Check vendor security advisories or commit histories (e.g., libtiff, ImageMagick, Pillow) for patches addressing PackBits decompression limits. Once patches are available, test in a staging environment to confirm compatibility, then roll out to production according to your deployment schedule. For open-source libraries, monitor GitHub releases and security mailing lists for fixes.

Detection guidance

Monitor for anomalous TIFF file processing: unusually high CPU or memory consumption during image decode operations, unexplained crashes in image processing services, or logs showing decompression timeouts. Implement file-upload validation rules that reject TIFF files with suspicious characteristics—extremely high compression ratios, declared dimensions that don't match file size, or abnormally large decompressed output predictions. Network detection is challenging without deep packet inspection, but endpoint telemetry showing resource spikes correlated with TIFF processing is a useful heuristic. Log and quarantine any uploaded TIFF files that trigger decoder errors or resource limits.

Why prioritize this

A CVSS 7.5 HIGH score reflects the network-exploitable, authentication-free nature of the attack and the severity of denial-of-service impact. Prioritize this vulnerability if your organization processes TIFF images from untrusted sources (user uploads, email, cloud storage, third-party APIs). Less urgent for environments that rarely encounter TIFF files or strictly validate and sanitize input before processing. However, given the ease of exploitation and the potential for service-level impact, this merits prompt investigation and patching in most IT environments.

Risk score, explained

CVSS 3.1 assigns a score of 7.5 (HIGH) based on network accessibility, no authentication requirement, low attack complexity, and high availability impact (A:H). The vulnerability does not compromise confidentiality or integrity, limiting the score from critical to high. The lack of user interaction (UI:N) and uniform scope (S:U) reflect the attacker's ability to trigger the flaw directly. In operational risk assessment, the ease of crafting a weaponized image and the prevalence of TIFF processing in real-world systems justify taking this vulnerability seriously despite it being availability-only.

Frequently asked questions