CVE catalog

CVE-2025-8961

LibTIFF vulnerabilities

[CVE catalog]

Severity
Low · CVSS 3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.21% · Oct 25, 2026

A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantiffsid4.7.2-1fixed
Debiantiffforky4.7.2-1fixed
Debiantifftrixie4.7.0-3+deb13u3fixed
Debiantifftrixie-security4.7.0-3+deb13u3fixed
Debiantiffbookworm4.5.0-6+deb12u4vulnerable
Debiantiffbookworm-security4.5.0-6+deb12u4vulnerable
UbuntutiffnobleNot reportedvulnerable
Ubuntutiffnoble4.5.1+git230720-4ubuntu2.4fixed
Ubuntulibtiff-devnoble4.5.1+git230720-4ubuntu2.4fixed
Ubuntulibtiff-docnoble4.5.1+git230720-4ubuntu2.4fixed
Ubuntulibtiff-openglnoble4.5.1+git230720-4ubuntu2.4fixed
Ubuntulibtiff-toolsnoble4.5.1+git230720-4ubuntu2.4fixed
Ubuntulibtiff5-devnoble4.5.1+git230720-4ubuntu2.4fixed
Ubuntulibtiff6noble4.5.1+git230720-4ubuntu2.4fixed
Ubuntulibtiffxx6noble4.5.1+git230720-4ubuntu2.4fixed
Alpinetiff3.214.7.1-r0fixed
Alpinetiff3.224.7.1-r0fixed
Alpinetiff3.234.7.1-r0fixed
Alpinetiff3.244.7.1-r0fixed
Ubuntutiffpro4.0.10+git191003-1vulnerable
Ubuntutiffpro4.1.0+git191117-1vulnerable
Ubuntutiffpro4.1.0+git191117-2vulnerable
Ubuntutiffpro4.1.0+git191117-2build1vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.1vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.2vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.3vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.4vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.5vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.6vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.7vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.8vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.9vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.10vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.11vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.12vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.13vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.14vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.14+esm1vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.14+esm2fixed
Ubuntutiff22.044.3.0-1vulnerable
Ubuntutiff22.044.3.0-2vulnerable
Ubuntutiff22.044.3.0-3vulnerable
Ubuntutiff22.044.3.0-3build1vulnerable
Ubuntutiff22.044.3.0-4vulnerable
Ubuntutiff22.044.3.0-5vulnerable
Ubuntutiff22.044.3.0-6vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.1vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.2vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.3vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.4vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.5vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.6vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.7vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.8vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.9vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.10vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.11vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.12fixed
Ubuntutiff24.044.5.1+git230720-1ubuntu1vulnerable
Ubuntutiff24.044.5.1+git230720-3ubuntu1vulnerable
Ubuntutiff24.044.5.1+git230720-4ubuntu1vulnerable
Ubuntutiff24.044.5.1+git230720-4ubuntu2vulnerable
Ubuntutiff24.044.5.1+git230720-4ubuntu2.1vulnerable
Ubuntutiff24.044.5.1+git230720-4ubuntu2.2vulnerable
Ubuntutiff24.044.5.1+git230720-4ubuntu2.3vulnerable
Ubuntutiff24.044.5.1+git230720-4ubuntu2.4fixed
Ubuntutiffpro4.0.10+git191003-1vulnerable
Ubuntutiffpro4.1.0+git191117-1vulnerable
Ubuntutiffpro4.1.0+git191117-2vulnerable
Ubuntutiffpro4.1.0+git191117-2build1vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.1vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.2vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.3vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.4vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.5vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.6vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.7vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.8vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.9vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.10vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.11vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.12vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.13vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.14vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.14+esm1vulnerable
Ubuntutiffpro4.1.0+git191117-2ubuntu0.20.04.14+esm2fixed
Ubuntutiff22.044.3.0-1vulnerable
Ubuntutiff22.044.3.0-2vulnerable
Ubuntutiff22.044.3.0-3vulnerable
Ubuntutiff22.044.3.0-3build1vulnerable
Ubuntutiff22.044.3.0-4vulnerable
Ubuntutiff22.044.3.0-5vulnerable
Ubuntutiff22.044.3.0-6vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.1vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.2vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.3vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.4vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.5vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.6vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.7vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.8vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.9vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.10vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.11vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.12fixed
Ubuntutiff24.044.5.1+git230720-1ubuntu1vulnerable
Ubuntutiff24.044.5.1+git230720-3ubuntu1vulnerable
Ubuntutiff24.044.5.1+git230720-4ubuntu1vulnerable
Ubuntutiff24.044.5.1+git230720-4ubuntu2vulnerable
Ubuntutiff24.044.5.1+git230720-4ubuntu2.1vulnerable
Ubuntutiff24.044.5.1+git230720-4ubuntu2.2vulnerable
Ubuntutiff24.044.5.1+git230720-4ubuntu2.3vulnerable
Ubuntutiff24.044.5.1+git230720-4ubuntu2.4fixed
Ubuntutiff25.104.5.1+git230720-4ubuntu4vulnerable
Ubuntutiff25.104.7.0-3ubuntu1vulnerable
Ubuntutiff25.104.7.0-3ubuntu2vulnerable
Ubuntutiff25.104.7.0-3ubuntu3fixed
Opensusetifftumbleweed4.7.0-9.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantiffsourcesid4.7.0-5unimportantNot reported[1111317]
Debiantiffsourceforky4.7.0-5unimportantNot reported[1111317]
Debiantiffsourcetrixie4.7.0-3+deb13u1not yet assignedNot reported[1111317]
Debiantiffsourcebookworm(unfixed)unimportantNot reported[1111317]
Ubuntutiffdebnoble4.5.1+git230720-4ubuntu2.4Not reportedNot reportedNot reported
Ubuntulibtiff-devdebnoble4.5.1+git230720-4ubuntu2.4Not reportedNot reportedNot reported
Ubuntulibtiff-docdebnoble4.5.1+git230720-4ubuntu2.4Not reportedNot reportedNot reported
Ubuntulibtiff-opengldebnoble4.5.1+git230720-4ubuntu2.4Not reportedNot reportedNot reported
Ubuntulibtiff-toolsdebnoble4.5.1+git230720-4ubuntu2.4Not reportedNot reportedNot reported
Ubuntulibtiff5-devdebnoble4.5.1+git230720-4ubuntu2.4Not reportedNot reportedNot reported
Ubuntulibtiff6debnoble4.5.1+git230720-4ubuntu2.4Not reportedNot reportedNot reported
Ubuntulibtiffxx6debnoble4.5.1+git230720-4ubuntu2.4Not reportedNot reportedNot reported
Alpinetiffapk3.214.7.1-r0Not reportedALPINE-CVE-2025-8961Not reported
Alpinetiffapk3.224.7.1-r0Not reportedALPINE-CVE-2025-8961Not reported
Alpinetiffapk3.234.7.1-r0Not reportedALPINE-CVE-2025-8961Not reported
Alpinetiffapk3.244.7.1-r0Not reportedALPINE-CVE-2025-8961Not reported
Ubuntutiffdebpro4.1.0+git191117-2ubuntu0.20.04.14+esm2Not reportedUSN-7783-1Not reported
Ubuntutiffdeb22.044.3.0-6ubuntu0.12Not reportedUSN-7783-1Not reported
Ubuntutiffdeb24.044.5.1+git230720-4ubuntu2.4Not reportedUSN-7783-1Not reported
Ubuntutiffdebpro4.1.0+git191117-2ubuntu0.20.04.14+esm2Not reportedUBUNTU-CVE-2025-8961Not reported
Ubuntutiffdeb22.044.3.0-6ubuntu0.12Not reportedUBUNTU-CVE-2025-8961Not reported
Ubuntutiffdeb24.044.5.1+git230720-4ubuntu2.4Not reportedUBUNTU-CVE-2025-8961Not reported
Ubuntutiffdeb25.104.7.0-3ubuntu3Not reportedUBUNTU-CVE-2025-8961Not reported
Opensusetiffrpmtumbleweed4.7.0-9.1Not reportedOPENSUSE-SU-2025:15541-1Not reported

[Debian bug #1111317]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libtiff5-dev]Affected

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

  • [libtiff6]Affected

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

  • [libtiff-dev]Affected

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

  • [libtiff-doc]Affected

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · all · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · all · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · all · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · all · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

  • [libtiff-opengl]Affected

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

  • [libtiff-tools]Affected

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

  • [libtiffxx6]Affected

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Affected

      usn · tiff · debian · bookworm; usn · tiff · debian · 12

[openSUSE Tumbleweed]

  • [libtiff6]Unknown

    Source package: [tiff]

    Details (1)
    • 4.7.2-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 4.7.0-9.1

      Version impact unknown

      usn · tiff · opensuse · tumbleweed

  • Source package: [tiff]

    Details (1)
    • 4.7.2-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 4.7.0-9.1

      Version impact unknown

      usn · tiff · opensuse · tumbleweed

  • [libtiff-devel]Unknown

    Source package: [tiff]

    Details (1)
    • 4.7.2-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 4.7.0-9.1

      Version impact unknown

      usn · tiff · opensuse · tumbleweed

  • Source package: [tiff]

    Details (1)
    • 4.7.2-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 4.7.0-9.1

      Version impact unknown

      usn · tiff · opensuse · tumbleweed

  • [tiff]Fixed

    Source package: [tiff]

    Details (1)
    • 4.7.2-1.2 · x86_64 · tumbleweed

      Fixed · Fixed: 4.7.0-9.1

      usn · tiff · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

  • [libtiff6]Fixed

    Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

  • Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

  • Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · all · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u2 · all · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · all · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · all · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

  • Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

  • Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

  • [libtiffxx6]Fixed

    Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

    • 4.7.0-3+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 4.7.0-3+deb13u1

      usn · tiff · debian · 13

Observed:

References