Fedora tkimg Heap Overflow Vulnerability Advisory

A heap-based buffer overflow vulnerability (CVE-2026-12912) was identified in the tkimg package of Fedora, affecting versions prior to 2.1.1. This flaw allows attackers to exploit crafted PixarLog-compressed TIFF images to potentially execute arbitrary code. The vulnerability was published on 2026-06-29, and Fedora has released an update to version 2.1.1 to address this issue. Users are advised to upgrade their systems using the 'dnf' update program to mitigate the risk. The vulnerability impacts all Fedora users utilizing the tkimg package. Current status indicates that the vulnerability is patched, but users must ensure they apply the updates promptly. The advisory emphasizes the importance of maintaining up-to-date systems to prevent exploitation.

Key Points: • CVE-2026-12912 is a heap overflow vulnerability in Fedora's tkimg package. • The flaw allows exploitation via crafted TIFF images, posing a risk of arbitrary code execution. • Fedora has released an update (2.1.1) to mitigate this vulnerability, urging users to upgrade.