Critical Security Flaw in libtiff: Write-What-Where Vulnerability
Summary
ALSA-2025:19156: Important: libtiff security update. Affects libtiff versions < 4.6.0-6.el10_0.1. Fixed in 4.6.0-6.el10_0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtiff is a widely-used library for manipulating Tagged Image File Format (TIFF) files, providing essential functions for reading and writing TIFF images. It is integral to various applications that require image processing capabilities. The library's extensive use in both open-source and commercial software makes it a critical component in many systems. However, vulnerabilities in libtiff can lead to severe security risks, including unauthorized access and data manipulation.
Vulnerability Detail
The vulnerability identified as CVE-2025-9900 is a Write-What-Where flaw in libtiff, which allows an attacker to write arbitrary data to a specific location in memory. This can lead to potential exploitation, including the execution of arbitrary code, data corruption, or denial of service. The flaw arises from improper handling of input data, making it crucial for users to address this issue promptly to safeguard their systems.
How To Fix
Minimum fixed version
4.6.0-6.el10_0.1
This is the first release that contains the fix.
sudo dnf update libtiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the libtiff library or avoid processing untrusted TIFF files until the update is applied. However, this is not a permanent solution and should only be used until the patch is implemented.
Conclusion
The libtiff library has a critical vulnerability (CVE-2025-9900) that poses significant risks to systems using it. Users are strongly advised to update to the patched version to mitigate potential threats. Additionally, utilizing tools like Vulert can help in monitoring vulnerabilities in real-time.
See every vulnerability recorded for libtiff →
FAQ
CVE-2025-9900 is a security vulnerability in the libtiff library that allows attackers to exploit a Write-What-Where flaw, potentially leading to arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability can lead to unauthorized access, data corruption, and potential system compromise, making it critical to apply the patch.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If an immediate update is not possible, restrict access to the libtiff library and avoid processing untrusted TIFF files until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for libtiff.
