Introduction
Remote code execution and denial of service are possible on any system that uses LibTIFF to process untrusted TIFF images. Document management systems, web platforms, and any other application that relies on LibTIFF for image parsing are directly affected. A specially crafted image file can trigger the flaw, and the user interaction it needs is minimal: opening or processing the file is enough.
LibTIFF is a foundational open-source library for handling TIFF images. It is embedded in imaging suites, scientific applications, web services, and operating systems. Because so many products depend on it, a vulnerability in LibTIFF can cascade across many products and industries.
Technical information
CVE-2025-9900 is a write-what-where vulnerability, classified as CWE-123. It is triggered when LibTIFF processes a TIFF file whose metadata contains an abnormally large image height value. The result is improper pointer arithmetic and memory access violations, which let attacker-controlled color data be written to arbitrary memory locations.
The root cause is that LibTIFF does not properly validate the image height parameter during its internal calculations. A maliciously large value causes integer overflows or pointer miscalculations, and those give the attacker control over both the destination address and the data written there. The most likely exploitation paths overwrite function pointers, return addresses, or other critical memory structures. The outcome is denial of service or arbitrary code execution with the privileges of the affected process.
Public research and analysis have shown that an attacker can exploit the flaw by manipulating register values during TIFF parsing. During the vulnerable memory write, for example, the attacker can control the target address (e.g., via RAX) and the payload data (e.g., via RCX). The attack vector is network-based. A malicious TIFF file triggers the flaw when it is opened or processed, whether by a user directly or by an automated processing system.
This post includes no code from the vulnerable source. The references link to detailed technical writeups and proof-of-concept code.
Patch information
Red Hat has released an updated libtiff package for Red Hat Enterprise Linux 8 that fixes CVE-2017-17095, a heap-based buffer overflow in the pal2rgb tool of the libtiff package. The update, detailed in RHSA-2025:4658, upgrades libtiff to version 4.0.9-34.el8_10. (lists.suse.com)
That vulnerability came from improper handling of certain TIFF files and could lead to denial of service. The patch adds checks and validations inside the pal2rgb tool to prevent the buffer overflow. Users should update their libtiff packages to this version to mitigate the risk from this vulnerability.
Affected systems and versions
- LibTIFF up to and including version 4.7.0 is affected
- All platforms and products that embed a LibTIFF version earlier than the patched release are vulnerable
- The vulnerability is present in any configuration where LibTIFF processes untrusted TIFF files
Vendor security history
LibTIFF has a long history of memory corruption and overflow vulnerabilities. According to CVE statistics, 63 overflow and 38 memory corruption issues have been reported in recent years. 2017 and 2023 stand out, with 19 and 14 overflow vulnerabilities respectively. Vendor response times have varied, though some critical issues were patched within weeks. A volunteer community maintains the project, and because LibTIFF is used so widely, its vulnerabilities can have broad and cascading effects.
