Log in Start free

Vulnerability · Published Aug 14, 2025 · Assigned by VulDB

CVE-2025-8961LibTIFF tiffcrop tiffcrop.c main memory corruption

Low 3.3

In plain English

A low-severity memory corruption in LibTIFF. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 86.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.21tiff4.7.1-r0ALPINE-CVE-2025-8961
Alpine:v3.22tiff4.7.1-r0ALPINE-CVE-2025-8961
Alpine:v3.23tiff4.7.1-r0ALPINE-CVE-2025-8961
Alpine:v3.24tiff4.7.1-r0ALPINE-CVE-2025-8961
Debian:12tiffno fix listedDEBIAN-CVE-2025-8961
Debian:13tiff4.7.0-3+deb13u1DEBIAN-CVE-2025-8961
Debian:14tiff4.7.0-5DEBIAN-CVE-2025-8961
Ubuntu:22.04:LTStiff4.3.0-6ubuntu0.12USN-7783-1
Ubuntu:22.04:LTStiff4.3.0-6ubuntu0.12UBUNTU-CVE-2025-8961
Ubuntu:24.04:LTStiff4.5.1+git230720-4ubuntu2.4UBUNTU-CVE-2025-8961
Ubuntu:24.04:LTStiff4.5.1+git230720-4ubuntu2.4USN-7783-1
Ubuntu:25.10tiff4.7.0-3ubuntu3UBUNTU-CVE-2025-8961

Affected products (as reported)

VendorProductVersions
n/a LibTIFF 4.7.0

Weakness: CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

References