Log in Start free

Vulnerability · Published Jul 26, 2025 · Assigned by VulDB

CVE-2025-8177LibTIFF thumbnail.c setrow buffer overflow

Medium 5.3

In plain English

A medium-severity buffer overflow in LibTIFF. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 74.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12tiffno fix listedDEBIAN-CVE-2025-8177
Debian:13tiffno fix listedDEBIAN-CVE-2025-8177
Debian:14tiff4.7.1-1DEBIAN-CVE-2025-8177
Ubuntu:22.04:LTStiff4.3.0-6ubuntu0.11USN-7707-1
Ubuntu:24.04:LTStiff4.5.1+git230720-4ubuntu2.3USN-7707-1

Affected products (as reported)

VendorProductVersions
n/a LibTIFF 4.04.14.24.34.44.54.64.7.0

Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References