Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

CVE-2025-9900

Libtiff: libtiff write-what-where

HIGH 8.8

At a glance

Source
NVD
EPSS
EPSS 0.97 % · percentile 62 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Deferred

Description

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

Weaknesses (CWE)

  • CWE-123 — Write-what-where Condition

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hredhat
CVSS 3.1HIGH 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HNVD · secalert@redhat.com (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
libtiffaffected 0 < 4.7.1
Red Hat · Red Hat Enterprise Linux 10unaffected 0:4.6.0-6.el10_0.1 < *
Red Hat · Red Hat Enterprise Linux 10unaffected 0:4.6.0-6.el10_1.1 < *
Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Supportunaffected 0:3.9.4-12.el7_9.1 < *
Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Supportunaffected 0:4.0.3-35.el7_9.1 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:3.9.4-14.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:4.0.9-35.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:4.0.9-3.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 0:3.9.4-13.el8_2.1 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 0:4.0.9-17.el8_2.1 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 0:8.10-3.el8_2.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 0:3.9.4-13.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 0:4.0.9-18.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 0:8.10-3.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 0:3.9.4-13.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 0:4.0.9-18.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 0:8.10-3.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 0:3.9.4-13.el8_6.1 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 0:4.0.9-21.el8_6.1 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 0:8.10-3.el8_6.1 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD