Skip to content
Fencer Vulns
medium 5.3

CVE-2025-8176 json

LibTIFF tiffmedian.c get_histogram use after free

published 2025-07-26 15 mo ago modified 2026-07-25 3 mo ago also EUVD-2025-22777 , JLSEC-2025-317

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.

Patch / fix

  • julia Libtiff_jll 4.7.2+0
  • tiff Debian 14 4.7.1-1

debian advisories DEBIAN-CVE-2025-8176

  • tiff Ubuntu 22.04 LTS 4.3.0-6ubuntu0.11
  • tiff Ubuntu 24.04 LTS 4.5.1+git230720-4ubuntu2.3
  • tiff Ubuntu Pro 14.04 LTS 4.0.3-7ubuntu0.11+esm15
  • tiff Ubuntu Pro 16.04 LTS 4.0.6-1ubuntu0.8+esm18
  • tiff Ubuntu Pro 18.04 LTS 4.0.9-5ubuntu0.10+esm8
  • tiff Ubuntu Pro 20.04 LTS 4.1.0+git191117-2ubuntu0.20.04.14+esm1

ubuntu advisories UBUNTU-CVE-2025-8176

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libtiff RHEL 9 4.4.0-15.el9_7.2
  • libtiff-tools RHEL 9 4.4.0-15.el9_7.2
  • libtiff RHEL 8 4.0.9-36.el8_10
  • libtiff-tools RHEL 8 4.0.9-36.el8_10
  • mingw-libtiff RHEL 8 4.0.9-3.el8_10
  • mingw32-libtiff RHEL 8 4.0.9-3.el8_10
  • mingw64-libtiff RHEL 8 4.0.9-3.el8_10
  • libtiff RHEL 9 4.4.0-13.el9_6.2

red hat advisories RHSA-2026:0077RHSA-2026:0078RHSA-2026:0076RHSA-2026:0001RHSA-2025:21508RHSA-2025:21507

  • tiff SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.7.1-160000.1.1
  • tiff Linux Micro 6.0 4.7.1-1.1
  • tiff Linux Micro 6.1 4.7.1-slfo.1.1_1.1
  • tiff SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +17 more 4.0.9-150000.45.50.1
  • tiff SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, SLE Module for Basesystem 15 SP7 +2 more 4.7.0-150600.3.13.1
  • tiff SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 4.0.9-44.89.1

suse advisories SUSE-SU-2025:21009-1SUSE-SU-2025:21032-1SUSE-SU-2025:21037-1SUSE-SU-2025:20971-1SUSE-SU-2025:02815-1SUSE-SU-2025:02771-1

  • tiff openSUSE Leap 16.0 4.7.1-160000.1.1
  • tiff-man openSUSE Leap 16.0 4.7.1-160000.1.1
  • tiff openSUSE Tumbleweed 4.7.0-7.1

opensuse advisories openSUSE-SU-2025:20049-1openSUSE-SU-2025:15417-1

  • libtiff AlmaLinux 9 4.4.0-15.el9_7.2
  • libtiff-tools AlmaLinux 9 4.4.0-15.el9_7.2
  • libtiff AlmaLinux 8 4.0.9-36.el8_10
  • libtiff-tools AlmaLinux 8 4.0.9-36.el8_10
  • mingw32-libtiff AlmaLinux 8 4.0.9-3.el8_10
  • mingw64-libtiff AlmaLinux 8 4.0.9-3.el8_10
  • libtiff AlmaLinux 9 4.4.0-13.el9_6.2
  • libtiff-tools AlmaLinux 9 4.4.0-13.el9_6.2

almalinux advisories ALSA-2025:20956ALSA-2025:20034ALSA-2025:19906ALSA-2025:19113

  • libtiff Rocky Linux 9 4.4.0-15.el9_7.2.0.1
  • libtiff Rocky Linux 8 4.0.9-36.el8_10
  • mingw-libtiff Rocky Linux 8 4.0.9-3.el8_10
  • libtiff Rocky Linux 9 4.4.0-13.el9_6.2

rocky linux advisories RLSA-2025:20956RLSA-2025:20034RLSA-2025:19906RLSA-2025:19113

  • libtiff Azure Linux 3.0 4.6.0-7
  • libtiff CBL-Mariner 2.0 4.6.0-8

azure linux advisories AZL-65973AZL-65981

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-8176 updated cvss 7.8

libtiff: LibTIFF Use-After-Free Vulnerability

  • Red Hat AI Inference Server 3.2 rhaiis 1772160593, rhaiis 1772160625, rhaiis 3.2.2-1764871796, rhaiis 3.2.2-1765379049, rhaiis 3.2.2-1765379088
    fixed: vendor fix RHSA-2025:23080
  • Red Hat CodeReady Linux Builder EUS (v.9.4) libtiff-tools 4.4.0-12.el9_4.4
    fixed: vendor fix RHSA-2025:21507
  • Red Hat Discovery 2 discovery 2.4.0-1763656152
    fixed: vendor fix RHSA-2025:21994
  • Red Hat Enterprise Linux AppStream (v. 8) libtiff 4.0.9-36.el8_10
    fixed: vendor fix RHSA-2025:20034
  • Red Hat Enterprise Linux AppStream (v. 9) libtiff 4.4.0-13.el9_6.2, libtiff 4.4.0-15.el9_7.2
    fixed: vendor fix RHSA-2025:19113
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) spice-client-win 8.10-3.el8_2.1, spice-client-win-x64 8.10-3.el8_2.1, spice-client-win-x86 8.10-3.el8_2.1
    fixed: vendor fix RHSA-2026:0078
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) spice-client-win 8.10-3.el8_4.1, spice-client-win-x64 8.10-3.el8_4.1, spice-client-win-x86 8.10-3.el8_4.1
    fixed: vendor fix RHSA-2026:0077
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) spice-client-win 8.10-3.el8_6.1, spice-client-win-x64 8.10-3.el8_6.1, spice-client-win-x86 8.10-3.el8_6.1 Red Hat Enterprise Linux AppStream E4S (v.8.6) spice-client-win 8.10-3.el8_6.1, spice-client-win-x64 8.10-3.el8_6.1, spice-client-win-x86 8.10-3.el8_6.1
    fixed: vendor fix RHSA-2026:0076
show 10 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) spice-client-win 8.10-3.el8_8.1, spice-client-win-x64 8.10-3.el8_8.1, spice-client-win-x86 8.10-3.el8_8.1
    fixed: vendor fix RHSA-2026:0001
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) libtiff 4.4.0-8.el9_2.4
    fixed: vendor fix RHSA-2025:21508
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) libtiff 4.4.0-12.el9_4.4
    fixed: vendor fix RHSA-2025:21507
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) spice-client-win 8.10-3.el8_4.1, spice-client-win-x64 8.10-3.el8_4.1, spice-client-win-x86 8.10-3.el8_4.1
    fixed: vendor fix RHSA-2026:0077
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) spice-client-win 8.10-3.el8_6.1, spice-client-win-x64 8.10-3.el8_6.1, spice-client-win-x86 8.10-3.el8_6.1
    fixed: vendor fix RHSA-2026:0076
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) spice-client-win 8.10-3.el8_8.1, spice-client-win-x64 8.10-3.el8_8.1, spice-client-win-x86 8.10-3.el8_8.1
    fixed: vendor fix RHSA-2026:0001
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libtiff-tools 4.4.0-13.el9_6.2, libtiff-tools 4.4.0-15.el9_7.2
    fixed: vendor fix RHSA-2025:19113
  • Red Hat Enterprise Linux CRB (v. 8) mingw-libtiff 4.0.9-3.el8_10, libtiff-tools 4.0.9-36.el8_10, mingw32-libtiff 4.0.9-3.el8_10, mingw64-libtiff 4.0.9-3.el8_10
    fixed: vendor fix RHSA-2025:20034
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS) libtiff-tools 4.0.3-35.el7_9.1
    fixed: vendor fix RHSA-2025:21407
  • Red Hat Discovery 2 discovery 2.4.0-1763596485 Red Hat Enterprise Linux 6 libtiff Red Hat Enterprise Linux 7 compat-libtiff3 Red Hat Enterprise Linux 8 compat-libtiff3 Red Hat Enterprise Linux 10 libtiff Red Hat Enterprise Linux Server (v. 7 ELS) libtiff 4.0.3-35.el7_9.1
    +1 more products
    Red Hat Enterprise Linux Server Optional (v. 7 ELS) libtiff-static 4.0.3-35.el7_9.1, libtiff-debuginfo 4.0.3-35.el7_9.1
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
15 mo ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gitlab.com https://gitlab.com/libtiff/libtiff/-/issues/707 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA 3.1 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA 3.0 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA 2.0 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
CNA 4.0 1.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 2.0 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P
OSV 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
julia Libtiff_jll
<4.7.2+0
4.7.2+0

Affected products

  • n/a LibTIFF

Classification

Weakness
  • CWE-416 Use After Free
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.