ALAS2-2026-3921

Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-3921
Advisory Released Date: 2026-09-14
Advisory Updated Date: 2026-09-14
Severity: Important
Issue Overview:

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c (CVE-2026-52490)

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component (CVE-2026-52491)

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image (CVE-2026-52492)


Affected Packages:

libtiff


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update libtiff or yum update --advisory ALAS2-2026-3921 to update your system.

New Packages:
aarch64:
    libtiff-4.0.3-35.amzn2.0.32.aarch64
    libtiff-devel-4.0.3-35.amzn2.0.32.aarch64
    libtiff-static-4.0.3-35.amzn2.0.32.aarch64
    libtiff-tools-4.0.3-35.amzn2.0.32.aarch64
    libtiff-debuginfo-4.0.3-35.amzn2.0.32.aarch64

i686:
    libtiff-4.0.3-35.amzn2.0.32.i686
    libtiff-devel-4.0.3-35.amzn2.0.32.i686
    libtiff-static-4.0.3-35.amzn2.0.32.i686
    libtiff-tools-4.0.3-35.amzn2.0.32.i686
    libtiff-debuginfo-4.0.3-35.amzn2.0.32.i686

src:
    libtiff-4.0.3-35.amzn2.0.32.src

x86_64:
    libtiff-4.0.3-35.amzn2.0.32.x86_64
    libtiff-devel-4.0.3-35.amzn2.0.32.x86_64
    libtiff-static-4.0.3-35.amzn2.0.32.x86_64
    libtiff-tools-4.0.3-35.amzn2.0.32.x86_64
    libtiff-debuginfo-4.0.3-35.amzn2.0.32.x86_64

Additional References

Red Hat: CVE-2026-52490, CVE-2026-52491, CVE-2026-52492

Mitre: CVE-2026-52490, CVE-2026-52491, CVE-2026-52492