CVE-2025-9900: Libtiff: libtiff write-what-where

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-23 · updated 2026-09-26
Weakness: CWE-123

Description

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

Affected products

Red Hat AI Inference Server 3.2: all versions — fixed in 1772160593, 1772160625, 3.2.2-1764871796, 3.2.2-1765379049, 3.2.2-1765379088
Red Hat Discovery 2: all versions — fixed in 2.4.0-1763656152
Red Hat Enterprise Linux 10: all versions — fixed in 0:4.6.0-6.el10_0.1, 0:4.6.0-6.el10_1.1
Red Hat Enterprise Linux 7 Extended Lifecycle Support: all versions — fixed in 0:3.9.4-12.el7_9.1, 0:4.0.3-35.el7_9.1
Red Hat Enterprise Linux 8: all versions — fixed in 0:3.9.4-14.el8_10, 0:4.0.9-3.el8_10, 0:4.0.9-35.el8_10
Red Hat Enterprise Linux 8.2 Advanced Update Support: all versions — fixed in 0:3.9.4-13.el8_2.1, 0:4.0.9-17.el8_2.1, 0:8.10-3.el8_2.1
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: all versions — fixed in 0:3.9.4-13.el8_4.1, 0:4.0.9-18.el8_4.1, 0:8.10-3.el8_4.1
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: all versions — fixed in 0:3.9.4-13.el8_4.1, 0:4.0.9-18.el8_4.1, 0:8.10-3.el8_4.1
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 0:3.9.4-13.el8_6.1, 0:4.0.9-21.el8_6.1, 0:8.10-3.el8_6.1
Red Hat Enterprise Linux 8.6 Telecommunications Update Service: all versions — fixed in 0:3.9.4-13.el8_6.1, 0:4.0.9-21.el8_6.1, 0:8.10-3.el8_6.1
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions: all versions — fixed in 0:3.9.4-13.el8_6.1, 0:4.0.9-21.el8_6.1, 0:8.10-3.el8_6.1
Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 0:3.9.4-13.el8_8.1, 0:4.0.9-29.el8_8.1, 0:8.10-3.el8_8.1
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 0:3.9.4-13.el8_8.1, 0:4.0.9-29.el8_8.1, 0:8.10-3.el8_8.1
Red Hat Enterprise Linux 9: all versions — fixed in 0:4.4.0-13.el9_6.2, 0:4.4.0-15.el9_7.2
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions: all versions — fixed in 0:4.2.0-3.el9_0.2
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:4.4.0-8.el9_2.4
Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 0:4.4.0-12.el9_4.4
Red Hat Hardened Images: all versions — fixed in 4.7.1-2.1.hum1

How to fix

Upgrade to a fixed version: Red Hat AI Inference Server 3.2 1772160593, 1772160625, 3.2.2-1764871796, 3.2.2-1765379049; Red Hat Discovery 2 2.4.0-1763656152; Red Hat Enterprise Linux 10 0:4.6.0-6.el10_0.1, 0:4.6.0-6.el10_1.1; Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:3.9.4-12.el7_9.1, 0:4.0.3-35.el7_9.1; Red Hat Enterprise Linux 8 0:3.9.4-14.el8_10, 0:4.0.9-3.el8_10, 0:4.0.9-35.el8_10; Red Hat Enterprise Linux 8.2 Advanced Update Support 0:3.9.4-13.el8_2.1, 0:4.0.9-17.el8_2.1, 0:8.10-3.el8_2.1; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:3.9.4-13.el8_4.1, 0:4.0.9-18.el8_4.1, 0:8.10-3.el8_4.1; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:3.9.4-13.el8_4.1, 0:4.0.9-18.el8_4.1, 0:8.10-3.el8_4.1; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:3.9.4-13.el8_6.1, 0:4.0.9-21.el8_6.1, 0:8.10-3.el8_6.1; Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:3.9.4-13.el8_6.1, 0:4.0.9-21.el8_6.1, 0:8.10-3.el8_6.1; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:3.9.4-13.el8_6.1, 0:4.0.9-21.el8_6.1, 0:8.10-3.el8_6.1; Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:3.9.4-13.el8_8.1, 0:4.0.9-29.el8_8.1, 0:8.10-3.el8_8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-9900 or the next vulnerability affects your stack