Critical Security Flaw in libtiff: Write-What-Where Vulnerability
Summary
RLSA-2025:19156: Important: libtiff security update. Affects libtiff versions < 0:4.6.0-6.el10_0.1. Fixed in 0:4.6.0-6.el10_0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libtiff is a widely used library for manipulating Tagged Image File Format (TIFF) files, enabling applications to read and write TIFF images. It is integral to many software solutions that handle image processing and storage. The library's functionality includes support for various TIFF formats, compression methods, and image manipulation capabilities. However, it has recently been identified to have a significant security vulnerability that could compromise systems using this library.
Vulnerability Detail
The vulnerability identified as CVE-2025-9900 in libtiff is a Write-What-Where issue. This flaw allows an attacker to manipulate memory, potentially leading to arbitrary code execution. The ramifications of this vulnerability can be severe, as it may allow unauthorized access to sensitive data or control over affected systems. The vulnerability arises from improper handling of certain inputs, which can be exploited by crafting malicious TIFF files.
How To Fix
Minimum fixed version
0:4.6.0-6.el10_0.1
This is the first release that contains the fix.
sudo dnf update libtiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, a temporary workaround is to avoid processing untrusted TIFF files until the package is updated. This can help prevent potential exploitation of the vulnerability.
Conclusion
The libtiff library has a critical vulnerability (CVE-2025-9900) that poses significant risks to systems that utilize it. Users are strongly advised to update to the latest patched version to protect against potential exploitation. Additionally, temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for libtiff →
FAQ
CVE-2025-9900 is a security vulnerability in the libtiff library that allows for a Write-What-Where condition, potentially leading to arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts include unauthorized access to sensitive data, system compromise, and potential control over affected systems due to arbitrary code execution.
You can update libtiff by running the command 'sudo dnf update libtiff' in your terminal for Rocky Linux systems.
Yes, avoid processing untrusted TIFF files until the libtiff package is updated to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for libtiff.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
