CVE-2026-46602: TIFF Decoder Unbounded Memory Consumption Denial of Service

Technical summary

CVE-2026-46602 is a denial-of-service vulnerability in TIFF decoder implementations that lack tile size validation. The TIFF specification permits tiled image organization, but the affected decoder fails to enforce upper bounds on individual tile dimensions or aggregate tile memory consumption. An adversary can construct a TIFF file containing tile headers that declare extremely large dimensions, forcing the decoder to attempt allocation of massive memory buffers. This unbounded memory allocation leads to resource exhaustion and application failure. The vulnerability is reachable over the network without authentication when the vulnerable decoder is exposed through a web service or network protocol handler.

Business impact

Operational continuity is at risk for any organization that processes TIFF images as part of automated workflows, document management, medical imaging systems, or customer-facing applications. A single malicious file can bring down processing pipelines, delay critical image analysis, or render batch operations unusable. Service availability may be compromised if image processing is essential to business operations. While direct data theft is not a concern, the denial-of-service impact can create secondary effects such as missed SLAs, delayed diagnostics in healthcare contexts, or interrupted supply chain visibility.

Affected systems

Any software implementing TIFF decoding without tile size limits is vulnerable. This includes image processing libraries, document viewers, content management systems, and specialized tools used in medical imaging, printing, scanning, and graphics processing. The vendor and product listing is not available in the advisory data; organizations must identify which of their in-house or third-party software components include vulnerable TIFF decoders and check with those vendors for patch guidance.

Exploitability

Exploitability is high. The attack vector is network-based, requires no privileges or user interaction, and can be automated. An attacker needs only to host a malicious TIFF file and trick or socially engineer a target into opening it, or intercept image downloads. Alternatively, if the vulnerable decoder is exposed through an API or web service that accepts uploaded files, exploitation may require no user action at all—automated file processing becomes the attack surface. No special tools or deep technical knowledge are required beyond crafting a TIFF file with oversized tile metadata.

Remediation

Apply patches from your software vendor that enforce maximum tile size limits in the TIFF decoder. Vendors typically implement a reasonable cap on tile dimensions and aggregate tile memory to prevent unbounded allocation. Verify patch availability for each product in your environment. As an interim mitigation, disable or restrict TIFF processing where possible, use network controls to prevent untrusted image sources from reaching vulnerable systems, and apply file upload restrictions if images come from external users.

Patch guidance

Contact your software vendor to determine if patches are available for the specific TIFF decoder implementation you use. Since the vulnerability is in decoder logic rather than a single library, the patch timeline and version numbers vary by vendor. Review your vendor's security advisory for your product line and apply patches according to your change management process. If using open-source TIFF libraries, check for upstream fixes and rebuild components as needed.

Detection guidance

Monitor for memory spikes and process termination events correlated with TIFF file processing. Alert on any TIFF files with tile dimension headers that exceed documented safe limits (vendor-specific thresholds should be identified from patch documentation). Log and flag failed image decoding attempts, especially those accompanied by out-of-memory errors or kernel memory pressure signals. In network monitoring, detect unusual file uploads with TIFF MIME types or magic bytes, particularly from untrusted sources. Memory profiling tools can reveal excessive allocation attempts during image processing.

Why prioritize this

This vulnerability merits urgent attention due to its high CVSS score (7.5), network reachability, and absence of any authentication or user interaction requirement. While not yet listed in CISA's Known Exploited Vulnerabilities catalog, the simplicity of exploitation and the ubiquity of TIFF processing in enterprise systems mean real-world attacks are likely. Denial-of-service attacks against image processing can have cascading effects on dependent systems and business processes.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects network attack vector, low attack complexity, no privilege or interaction requirement, and high impact on availability. The attack does not threaten confidentiality or integrity directly, but the complete denial of service justifies the high severity rating. Organizations should treat this as a high-priority patch candidate for any system processing untrusted TIFF images.

Frequently asked questions