CVE-2025-9900
A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.
- Fix
- Available
- CVSS 3.1
- 8.8 HIGH
- EPSS
- 0.7% (51th percentile)
- Weakness
- CWE-123
- NVD status
- Deferred
- Published
- 2025-09-23
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
No indexed exploits for CVE-2025-9900 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2025-9900 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.