Critical Security Vulnerability in libtiff: Write-What-Where Flaw
Summary
RLSA-2025:19276: Important: libtiff security update. Affects libtiff versions < 0:4.0.9-35.el8_10. Fixed in 0:4.0.9-35.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtiff is a widely used library for manipulating Tagged Image File Format (TIFF) files, enabling applications to read and write TIFF images efficiently. It is integral to various software applications that require image processing capabilities. The library's functionality includes handling image compression, decompression, and manipulation, making it essential for developers working with image data. However, recent vulnerabilities have raised concerns about the security of this library, particularly with the identified Write-What-Where flaw.
Vulnerability Detail
The vulnerability identified as CVE-2025-9900 in libtiff is a Write-What-Where issue that can potentially allow an attacker to manipulate memory in a way that could lead to arbitrary code execution. This flaw arises from improper handling of certain inputs, which can be exploited to overwrite memory locations. The ramifications of this vulnerability are severe, as it can compromise the integrity and confidentiality of systems utilizing the affected library, leading to unauthorized access and control over the affected applications.
How To Fix
Minimum fixed version
0:4.0.9-35.el8_10
This is the first release that contains the fix.
sudo dnf update libtiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of the libtiff library in applications that process untrusted TIFF files until the package is updated. Additionally, implementing strict input validation can help mitigate the risk of exploitation.
Conclusion
The identified vulnerability in libtiff poses significant risks to applications that rely on this library for image processing. It is crucial for users to update to the latest patched version to mitigate potential security threats. By staying informed and proactive, developers can protect their systems from exploitation.
See every vulnerability recorded for libtiff →
FAQ
CVE-2025-9900 is a security vulnerability in the libtiff library that allows for a Write-What-Where attack, potentially leading to arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.8, indicating a critical level of severity.
If immediate updates are not possible, consider implementing input validation and limiting the use of libtiff in processing untrusted files as a temporary measure.
The libtiff library is maintained by the Rocky Enterprise Software Foundation and Red Hat, who are responsible for addressing security vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for libtiff.
