CVE-2025-9900
HIGH EPSS 49.9%
Published Sep 23, 20259mo ago · Modified Jun 17, 20261w ago
8.8 CVSS 3.1
Published Sep 23, 2025 9mo ago
Last Modified Jun 17, 2026 1w ago
Description
A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
49.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-123
References 39
- openwall.com http://www.openwall.com/lists/oss-security/2025/09/26/3
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:17651
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:17675
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:17710
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:17738
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:17739
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:17740
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:19113
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:19156
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:19276
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:19906
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:19947
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:20956
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:20998
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:21060
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:21061
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:21062
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:21407
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:21506
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:21507
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:21508
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:21994
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:23078
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:23079
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:23080
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:0001
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:0076
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:0077
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:0078
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:3461
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:3462
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:7504
- access.redhat.com https://access.redhat.com/security/cve/CVE-2025-9900
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2392784
- github.com https://github.com/SexyShoelessGodofWar/LibTiff-4.7.0-Write-What-Where?tab=readme-ov-file
- gitlab.com https://gitlab.com/libtiff/libtiff/-/issues/704
- gitlab.com https://gitlab.com/libtiff/libtiff/-/merge_requests/732
- libtiff.gitlab.io https://libtiff.gitlab.io/libtiff/releases/v4.7.1.html
- lists.debian.org https://lists.debian.org/debian-lts-announce/2025/09/msg00031.html
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.