[ Reason ]
Three sec issues were found in the tiff:

   * CVE-2026-52490: unsigned 32-bit integer overflow in the tiffcrop "-S"
     subdivision count computation (page->cols * page->rows) in
     tools/tiffcrop.c, which can lead to an out-of-bounds access.
   * CVE-2026-18495: heap-based buffer overflow caused by truncation of
     64-bit StripByteCounts values when processing crafted BigTIFF files.
   * CVE-2026-36849: denial of service when processing a crafted TIFF file
     containing a large SamplesPerPixel tag value.

None of these are regressions with respecto the the previous trixie version

[ Impact ]
If the update is not in trixie, libtiff and the command line tool in
trixie remain vulnerable to the tree issue mentioned above, one of
them a DoS.

[ Tests ]
Tests run in debusine
https://debusine.debian.net/debian/developers/work-request/1426324/

[ Risks ]
Low, the changes are self-contained backports

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

Sorry, I'm attaching the debdiff file

 Package maintainer is here. Your changes look good at first look. I
will try to do more checking.
 But there's a regression in tiff version 4.7.0 which was fixed later
- but it landed in Sid after the Trixie release. Some users would like
to use it and filed [1] for a trixie-pu request. Upstream patch [2] is
moderate, but it is covered by self-testing. If you have time, please
add this to your PU as well. It would help to prevent another PU
request with only this patch later on.

Thanks,
Laszlo/GCS
[1] https://bugs.debian.org/1149347
[2] https://gitlab.com/libtiff/libtiff/-/commit/7cc3a06c28ac296db6f4ef30e5798916f34ffb10

Thanks for noted it.

I'm attaching the debdiff including this new patch.