Critical Security Update for libtiff: Addressing Use-After-Free and Write-What-Where Vulnerabilities
Summary
ALSA-2025:20956: Important: libtiff security update. Affects libtiff versions < 4.4.0-15.el9_7.2. Fixed in 4.4.0-15.el9_7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtiff is a widely-used library for manipulating Tagged Image File Format (TIFF) files, providing essential functions for reading and writing TIFF images. It is an integral component in various applications that require image processing. However, recent vulnerabilities have been identified that could potentially compromise the security of systems utilizing this library.
Vulnerability Detail
The libtiff library has been found to contain two significant vulnerabilities: a Use-After-Free vulnerability (CVE-2025-8176) and a Write-What-Where vulnerability (CVE-2025-9900). The Use-After-Free vulnerability allows an attacker to exploit memory that has already been freed, potentially leading to arbitrary code execution. The Write-What-Where vulnerability enables an attacker to manipulate memory locations, which could also result in arbitrary code execution or data corruption. These vulnerabilities stem from improper memory management within the library, posing serious risks to applications that rely on libtiff for image processing.
How To Fix
Minimum fixed version
4.4.0-15.el9_7.2
This is the first release that contains the fix.
sudo dnf update libtiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to limit the use of libtiff in applications until the package can be updated. Additionally, consider using alternative libraries for TIFF file manipulation that do not exhibit these vulnerabilities.
Conclusion
The libtiff library has critical vulnerabilities that require immediate attention. Users should update to the latest patched version to mitigate risks associated with these vulnerabilities. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for libtiff →
FAQ
The vulnerabilities include a Use-After-Free vulnerability (CVE-2025-8176) and a Write-What-Where vulnerability (CVE-2025-9900), both of which can lead to arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
As a workaround, limit the use of libtiff in your applications and consider using alternative libraries for TIFF file manipulation until you can apply the update.
Exploitation of these vulnerabilities could allow attackers to execute arbitrary code, potentially compromising the security of the affected system and leading to data breaches.
For more details, refer to the CVE pages for CVE-2025-8176 and CVE-2025-9900, which provide in-depth information about the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for libtiff.
