CVE-2025-9900 Libtiff: libtiff write-what-where
Attackers can execute arbitrary code or crash applications by tricking Libtiff into writing data to arbitrary memory locations via crafted TIFF files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-9900?
CVE-2025-9900 is a high-severity memory corruption vulnerability in Red Hat AI Inference Server 3.2, published on 23 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file.
By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.
Weakness: CWE-123
Which versions are affected by CVE-2025-9900?
Linux distribution packages (40)
libtiff AlmaLinux:10 | All versions | 4.6.0-6.el10_0.1 |
libtiff AlmaLinux:10 | All versions | 4.6.0-6.el10_1.1 |
libtiff-devel AlmaLinux:10 | All versions | 4.6.0-6.el10_0.1 |
libtiff-devel AlmaLinux:10 | All versions | 4.6.0-6.el10_1.1 |
libtiff-tools AlmaLinux:10 | All versions | 4.6.0-6.el10_0.1 |
libtiff-tools AlmaLinux:10 | All versions | 4.6.0-6.el10_1.1 |
compat-libtiff3 AlmaLinux:8 | All versions | 3.9.4-14.el8_10 |
libtiff AlmaLinux:8 | All versions | 4.0.9-35.el8_10 |
libtiff-devel AlmaLinux:8 | All versions | 4.0.9-35.el8_10 |
libtiff-tools AlmaLinux:8 | All versions | 4.0.9-35.el8_10 |
libtiff Red Hat:enterprise_linux:10.0 | All versions | 0:4.6.0-6.el10_0.1 |
libtiff-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:4.6.0-6.el10_0.1 |
libtiff-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:4.6.0-6.el10_0.1 |
libtiff-devel Red Hat:enterprise_linux:10.0 | All versions | 0:4.6.0-6.el10_0.1 |
libtiff-tools Red Hat:enterprise_linux:10.0 | All versions | 0:4.6.0-6.el10_0.1 |
libtiff-tools-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:4.6.0-6.el10_0.1 |
libtiff Red Hat:enterprise_linux:10.1 | All versions | 0:4.6.0-6.el10_1.1 |
libtiff-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:4.6.0-6.el10_1.1 |
libtiff-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:4.6.0-6.el10_1.1 |
libtiff-devel Red Hat:enterprise_linux:10.1 | All versions | 0:4.6.0-6.el10_1.1 |
libtiff-tools Red Hat:enterprise_linux:10.1 | All versions | 0:4.6.0-6.el10_1.1 |
libtiff-tools-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:4.6.0-6.el10_1.1 |
compat-libtiff3 Red Hat:enterprise_linux:8::appstream | All versions | 0:3.9.4-14.el8_10 |
compat-libtiff3-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.9.4-14.el8_10 |
compat-libtiff3-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:3.9.4-14.el8_10 |
libtiff Red Hat:enterprise_linux:8::appstream | All versions | 0:4.0.9-35.el8_10 |
libtiff-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:4.0.9-35.el8_10 |
libtiff-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:4.0.9-35.el8_10 |
libtiff-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:4.0.9-35.el8_10 |
libtiff-tools-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:4.0.9-35.el8_10 |
libtiff-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:4.0.9-35.el8_10 |
libtiff-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:4.0.9-35.el8_10 |
libtiff-tools Red Hat:enterprise_linux:8::crb | All versions | 0:4.0.9-35.el8_10 |
libtiff-tools-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:4.0.9-35.el8_10 |
compat-libtiff3 Red Hat:rhel_aus:8.2::appstream | All versions | 0:3.9.4-13.el8_2.1 |
libtiff Red Hat:rhel_aus:8.2::appstream | All versions | 0:4.0.9-17.el8_2.1 |
libtiff-debuginfo Red Hat:rhel_aus:8.2::appstream | All versions | 0:4.0.9-17.el8_2.1 |
libtiff-debugsource Red Hat:rhel_aus:8.2::appstream | All versions | 0:4.0.9-17.el8_2.1 |
libtiff-devel Red Hat:rhel_aus:8.2::appstream | All versions | 0:4.0.9-17.el8_2.1 |
libtiff-tools-debuginfo Red Hat:rhel_aus:8.2::appstream | All versions | 0:4.0.9-17.el8_2.1 |
How do I fix CVE-2025-9900?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-9900 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-9900 exists.
Sources
Also known as ALSA-2025:17675, ALSA-2025:19156, ALSA-2025:19276, ALSA-2025:20998, AZL-67722, AZL-67739 and 38 more.