CVE-2025-9900

Libtiff: libtiff write-what-where

View on CVE.org
Published Sep 23, 2025 CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed
Description
A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file.

By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4315-1 tiff security update
Debian DSA Debian DSA DSA-6023-1 tiff security update
EUVD EUVD EUVD-2025-30917 A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.
Ubuntu USN Ubuntu USN USN-7783-1 LibTIFF vulnerabilities
Ubuntu USN Ubuntu USN USN-8345-1 GDAL vulnerability
Ubuntu USN Ubuntu USN USN-8346-1 Texmaker vulnerabilities
Ubuntu USN Ubuntu USN USN-8347-1 QT WebEngine vulnerability
References
Link Providers
http://www.openwall.com/lists/oss-security/2025/09/26/3 cve-icon
https://access.redhat.com/errata/RHSA-2025:17651 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:17675 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:17710 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:17738 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:17739 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:17740 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:19113 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:19156 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:19276 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:19906 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:19947 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:20956 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:20998 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:21060 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:21061 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:21062 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:21407 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:21506 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:21507 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:21508 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:21994 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:23078 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:23079 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:23080 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:0001 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:0076 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:0077 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:0078 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:3461 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:3462 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:7504 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2025-9900 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2392784 cve-icon cve-icon
https://github.com/SexyShoelessGodofWar/LibTiff-4.7.0-Write-What-Where?tab=readme-ov-file cve-icon cve-icon cve-icon cve-icon
https://gitlab.com/libtiff/libtiff/-/issues/704 cve-icon cve-icon
https://gitlab.com/libtiff/libtiff/-/merge_requests/732 cve-icon cve-icon
https://libtiff.gitlab.io/libtiff/releases/v4.7.1.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/09/msg00031.html cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-9900 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-9900 cve-icon
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:rhel_els:6
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos
Type Values Removed Values Added
First Time appeared Redhat rhivos
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat hummingbird
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Redhat ai Inference Server
CPEs cpe:/a:redhat:ai_inference_server:3.2::el9
Vendors & Products Redhat ai Inference Server
References
Type Values Removed Values Added
First Time appeared Redhat discovery
CPEs cpe:/a:redhat:discovery:2::el9
Vendors & Products Redhat discovery
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.0::appstream
References
Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/a:redhat:rhel_eus:9.4::crb
Vendors & Products Redhat rhel Eus
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:7
References
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.1
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::crb
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.0
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
References
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
Vendors & Products Redhat rhel E4s
Redhat rhel Tus
References
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
References
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Eus Long Life
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Vendors & Products Redhat rhel Aus
Redhat rhel Eus Long Life
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos
Type Values Removed Values Added
First Time appeared Redhat rhivos
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description No description is available for this CVE. A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.
Title libtiff: Libtiff Write-What-Where Libtiff: libtiff write-what-where
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Type Values Removed Values Added
Description No description is available for this CVE.
Title libtiff: Libtiff Write-What-Where
Weaknesses CWE-123
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important
Earlier changes (32)
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 4, 2026, 9:46 PM
Reserved
Sep 3, 2025, 3:01 AM

View source JSON

Updated
Nov 4, 2025, 9:15 PM

JSON

Status
Deferred
Published
Sep 23, 2025, 5:15 PM
Modified
Nov 4, 2026, 10:17 PM

View source JSON

Severity
Important
Public date
Sep 22, 2025, 2:29 PM

View source Bugzilla JSON

Updated
Apr 20, 2026, 7:30 PM

JSON