Critical Security Update: mingw-libtiff Vulnerabilities Addressed
Summary
ALSA-2025:19906: Important: mingw-libtiff security update. Affects mingw32-libtiff versions < 4.0.9-3.el8_10. Fixed in 4.0.9-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mingw-libtiff package provides a library for manipulating TIFF (Tagged Image File Format) images, which are commonly used for high-quality graphics. This package is essential for applications that require image processing capabilities. However, it has been found to contain vulnerabilities that could lead to severe security risks if exploited.
Vulnerability Detail
The vulnerabilities identified in the mingw-libtiff package include a Use-After-Free vulnerability (CVE-2025-8176) and a Write-What-Where vulnerability (CVE-2025-9900). The Use-After-Free vulnerability can allow an attacker to execute arbitrary code by manipulating memory after it has been freed, while the Write-What-Where vulnerability can enable an attacker to overwrite memory locations, potentially leading to data corruption or unauthorized access. Both vulnerabilities pose significant risks to the integrity and confidentiality of applications using this library.
How To Fix
Minimum fixed version
4.0.9-3.el8_10
This is the first release that contains the fix.
sudo dnf update mingw32-libtiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately possible, consider disabling any features that utilize the mingw-libtiff library until the update can be applied. This may reduce the risk of exploitation while you work on a permanent fix.
Conclusion
The mingw-libtiff package has critical vulnerabilities that need to be addressed promptly to ensure the security of applications relying on it. Updating to the latest patched version is essential to mitigate these risks. Utilize tools like Vulert to monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for mingw32-libtiff →
FAQ
mingw-libtiff is a library for reading and writing TIFF image files, commonly used in applications that require image processing.
The vulnerabilities include a Use-After-Free vulnerability (CVE-2025-8176) and a Write-What-Where vulnerability (CVE-2025-9900), both of which can lead to arbitrary code execution and memory corruption.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signing up.
As a workaround, consider disabling features that rely on the mingw-libtiff library until you can apply the necessary updates.
For detailed information about the vulnerabilities, refer to the CVE pages: CVE-2025-8176 and CVE-2025-9900.
Related vulnerabilities
Recent vulnerabilities recorded for mingw32-libtiff.
