Libtiff Vulnerability Allows Memory Corruption in TIFF Image Processing
CVE-2025-9900
8.8HIGH
What is CVE-2025-9900?
A security flaw in the Libtiff library enables a write-what-where condition that can be exploited through specially crafted TIFF image files. By manipulating the image's metadata to include an unusually large height value, attackers can deceive the library into writing malicious color data to arbitrary memory locations. This memory corruption poses risks including application crashes and may allow arbitrary code execution, potentially compromising user permissions.
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Gareth C (AnchorSec Ltd.) for reporting this issue.