Vulnerability in Libtiff
CVE-2025-9165
A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".
EPSS: 0.002 (11.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 2.5 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Libtiff — versions 4.7.0
- N/a Libtiff — versions 4.7.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (issue-tracking, Exploit, Issue Tracking, Vendor Advisory)
- cna@vuldb.com (Patch, patch, Issue Tracking, Vendor Advisory)
- cna@vuldb.com (Exploit, exploit)
- cna@vuldb.com (Patch, patch)
- cna@vuldb.com (Product, product)
- af854a3a-2127-422b-91ae-364da2661108 (Exploit, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-9165?
- CVE-2025-9165 is a low-severity vulnerability in Libtiff, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 2.5/10. Published 2025-08-19.
- How severe is CVE-2025-9165?
- Low severity. CVSS v3 base score is 2.5 out of 10.
- Is CVE-2025-9165 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.