Log in Start free

Vulnerability · Published Sep 23, 2025 · Assigned by redhat

CVE-2025-9900Libtiff: libtiff write-what-where

High 8.8

In plain English

A high-severity security flaw in libtiff. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 36.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8compat-libtiff33.9.4-14.el8_10ALSA-2025:17675
AlmaLinux:10libtiff4.6.0-6.el10_1.1ALSA-2025:20998
AlmaLinux:10libtiff4.6.0-6.el10_0.1ALSA-2025:19156
AlmaLinux:8libtiff4.0.9-35.el8_10ALSA-2025:19276
AlmaLinux:9libtiff4.4.0-13.el9_6.2ALSA-2025:19113
AlmaLinux:9libtiff4.4.0-15.el9_7.2ALSA-2025:20956
AlmaLinux:10libtiff-devel4.6.0-6.el10_0.1ALSA-2025:19156
AlmaLinux:10libtiff-devel4.6.0-6.el10_1.1ALSA-2025:20998
AlmaLinux:8libtiff-devel4.0.9-35.el8_10ALSA-2025:19276
AlmaLinux:9libtiff-devel4.4.0-13.el9_6.2ALSA-2025:19113
AlmaLinux:9libtiff-devel4.4.0-15.el9_7.2ALSA-2025:20956
AlmaLinux:10libtiff-tools4.6.0-6.el10_1.1ALSA-2025:20998
AlmaLinux:10libtiff-tools4.6.0-6.el10_0.1ALSA-2025:19156
AlmaLinux:8libtiff-tools4.0.9-35.el8_10ALSA-2025:19276
AlmaLinux:9libtiff-tools4.4.0-15.el9_7.2ALSA-2025:20956
AlmaLinux:9libtiff-tools4.4.0-13.el9_6.2ALSA-2025:19113
AlmaLinux:8mingw32-libtiff4.0.9-3.el8_10ALSA-2025:19906
AlmaLinux:8mingw32-libtiff-static4.0.9-3.el8_10ALSA-2025:19906
AlmaLinux:8mingw64-libtiff4.0.9-3.el8_10ALSA-2025:19906
AlmaLinux:8mingw64-libtiff-static4.0.9-3.el8_10ALSA-2025:19906
Debian:12tiff4.5.0-6+deb12u3DEBIAN-CVE-2025-9900
Debian:12tiff4.5.0-6+deb12u3DSA-6023-1
Debian:13tiff4.7.0-3+deb13u1DEBIAN-CVE-2025-9900
Debian:13tiff4.7.0-3+deb13u1DSA-6023-1
Debian:14tiff4.7.1-1DEBIAN-CVE-2025-9900
Rocky Linux:8compat-libtiff30:3.9.4-14.el8_10RLSA-2025:17675
Rocky Linux:10libtiff0:4.6.0-6.el10_0.1RLSA-2025:19156
Rocky Linux:8libtiff0:4.0.9-35.el8_10RLSA-2025:19276
Rocky Linux:9libtiff0:4.4.0-13.el9_6.2RLSA-2025:19113
Rocky Linux:9libtiff0:4.4.0-15.el9_7.2.0.1RLSA-2025:20956
Rocky Linux:8mingw-libtiff0:4.0.9-3.el8_10RLSA-2025:19906
Ubuntu:25.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2025-9900
Ubuntu:26.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2025-9900
Ubuntu:25.10texmakerno fix listedUBUNTU-CVE-2025-9900
Ubuntu:22.04:LTStiff4.3.0-6ubuntu0.12USN-7783-1
Ubuntu:22.04:LTStiff4.3.0-6ubuntu0.12UBUNTU-CVE-2025-9900
Ubuntu:24.04:LTStiff4.5.1+git230720-4ubuntu2.4UBUNTU-CVE-2025-9900
Ubuntu:24.04:LTStiff4.5.1+git230720-4ubuntu2.4USN-7783-1
Ubuntu:25.10tiff4.7.0-3ubuntu3UBUNTU-CVE-2025-9900
Ubuntu:26.04:LTStiff4.7.0-3ubuntu3UBUNTU-CVE-2025-9900

Affected products (as reported)

VendorProductVersions
libtiff 0 – before 4.7.1
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support see references
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support see references
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references

Weakness: CWE-123 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References