CVE-2025-8177 LibTIFF thumbnail.c setrow buffer overflow

Medium 4.8 Published 26 Jul 2025 Updated 28 Jul 2025

A local buffer overflow in LibTIFF's thumbnail tool allows attackers to execute arbitrary code or cause denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-8177?

CVE-2025-8177 is a medium-severity memory corruption vulnerability in Libtiff Libtiff, published on 26 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer.

Weakness: CWE-120, CWE-119

Which versions are affected by CVE-2025-8177?

It affects 1 product.

Products include Libtiff Libtiff.

How do I fix CVE-2025-8177?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-8177 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-8177 exists.

All Libtiff Libtiff vulnerabilities

Sources

Also known as AZL-65970, AZL-65978, BELL-CVE-2025-8177, CLSA-2025-1764886460, DEBIAN-CVE-2025-8177, ECHO-9fcc-05ad-7b54 and 10 more.