CVE-2025-8961 LibTIFF tiffcrop tiffcrop.c main memory corruption
Local attackers can exploit memory corruption in LibTIFF's tiffcrop utility to execute arbitrary code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-8961?
CVE-2025-8961 is a medium-severity memory corruption vulnerability in Libtiff Libtiff, published on 14 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.
Weakness: CWE-119
Which versions are affected by CVE-2025-8961?
It affects 1 product.
Linux distribution packages (1)
tiff openSUSE:Tumbleweed | All versions | 4.7.0-9.1 |
Products include Libtiff Libtiff.
How do I fix CVE-2025-8961?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-8961 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-8961 exists.
Other vulnerabilities in Libtiff Libtiff
Sources
Also known as ALPINE-CVE-2025-8961, AZL-66423, AZL-66426, BELL-CVE-2025-8961, DEBIAN-CVE-2025-8961, ECHO-ebc5-0965-ea5c and 6 more.