Junglewise Threat Intelligence

CVE-2025-9900: Libtiff write-what-where condition in TIFF image processing

CVE-2025-9900 · Severity: high · CVSS 8.8 · Published 2025-09-23

Technologies: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, Libtiff. Vendors: Red Hat, Libtiff.

Executive brief

Libtiff is a widely used software library for reading and writing TIFF image files. A vulnerability has been identified where processing a maliciously crafted image can allow an attacker to corrupt system memory. This could lead to a complete application crash or allow the attacker to take control of the system and execute unauthorized commands with the user's permissions.

Technical details

A 'write-what-where' condition (CWE-123) exists in Libtiff due to improper validation of image metadata. Specifically, an abnormally large image height value in a TIFF file's metadata can be used to trigger memory corruption. This allows an attacker to write controlled color data to arbitrary memory locations. The attack is typically delivered via a malicious TIFF file and requires a user to open or process the file using the vulnerable library. Successful exploitation can lead to arbitrary code execution or a denial of service (application crash). The issue is addressed in Libtiff version 4.7.1.

Affected products

  • Libtiff Libtiff < 4.7.1
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 10

Timeline

  • 2025-09-23: disclosed
  • 2025-09-23: advisory: NVD published the CVE record.
  • 2025-10-09: patched: Red Hat released security updates for RHEL 8.

References

Related threats