CVE-2025-9900: Libtiff write-what-where condition in TIFF image processing

CVE-2025-9900 · Severity: high · CVSS 8.8 · Published 2025-09-23

Libtiff is a widely used software library for reading and writing TIFF image files. A vulnerability has been identified where processing a maliciously crafted image can allow an attacker to corrupt system memory. This could lead to a complete application crash or allow the attacker to take control of the system and execute unauthorized commands with the user's permissions.

Technologies: Libtiff, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8. Vendors: Libtiff, Red Hat.

Quick answers

Is CVE-2025-9900 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-9900 being exploited in the wild.
How severe is CVE-2025-9900?
High severity, with a CVSS score of 8.8, published 23 September 2025.
Which products and versions are affected?
Libtiff < 4.7.1.
Is there a fix for CVE-2025-9900?
A patch was published on 2025-10-09: Red Hat released security updates for RHEL 8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-9900 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-9900?
Check whether you run Libtiff, Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 8 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A 'write-what-where' condition (CWE-123) exists in Libtiff due to improper validation of image metadata. Specifically, an abnormally large image height value in a TIFF file's metadata can be used to trigger memory corruption. This allows an attacker to write controlled color data to arbitrary memory locations. The attack is typically delivered via a malicious TIFF file and requires a user to open or process the file using the vulnerable library. Successful exploitation can lead to arbitrary code execution or a denial of service (application crash). The issue is addressed in Libtiff version 4.7.1.

Affected products

  • Libtiff Libtiff < 4.7.1
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 10

Timeline

  • 2025-09-23: disclosed
  • 2025-09-23: advisory: NVD published the CVE record.
  • 2025-10-09: patched: Red Hat released security updates for RHEL 8.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.