A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.
CVSS Details
- CVSS 4.0 Base Score: 1.9 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libtiff-toolsUpgrade libtiff-develUpgrade mingw32-libtiff-staticUpgrade mingw32-libtiffUpgrade mingw64-libtiff-staticUpgrade mingw64-libtiffUpgrade libtiff | Oct 29, 2025 | Oct 27, 2025 |
| Amazon Linux Ami 2 | — | Upgrade libtiffUpgrade libtiff-debuginfoUpgrade libtiff-staticUpgrade libtiff-toolsUpgrade libtiff-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libtiffUpgrade libtiff-debuginfoUpgrade libtiff-develUpgrade libtiff-tools-debuginfoUpgrade libtiff-debugsourceUpgrade libtiff-toolsUpgrade libtiff-static | Sep 9, 2025 | Jul 26, 2025 |
| Debian | — | No solution exists | Jul 28, 2025 | Jul 28, 2025 |
| Oracle_linux | — | Upgrade libtiff-staticUpgrade libtiff-toolsUpgrade mingw32-libtiff-staticUpgrade mingw64-libtiffUpgrade libtiffUpgrade mingw64-libtiff-staticUpgrade mingw32-libtiffUpgrade libtiff-devel | Oct 29, 2025 | Jul 26, 2025 |
| Redhat_linux | — | Upgrade libtiff-staticUpgrade libtiffUpgrade mingw32-libtiff-debuginfoUpgrade mingw64-libtiffUpgrade mingw64-libtiff-staticUpgrade libtiff-debuginfoUpgrade libtiff-develUpgrade mingw64-libtiff-debuginfoUpgrade libtiff-tools-debuginfoUpgrade libtiff-toolsUpgrade libtiff-debugsourceUpgrade mingw32-libtiff-staticUpgrade mingw32-libtiff | Jul 31, 2025 | Jul 26, 2025 |
| Rocky_linux | — | Upgrade libtiff-debuginfoUpgrade libtiff-toolsUpgrade libtiff-develUpgrade libtiff-tools-debuginfoUpgrade libtiffUpgrade libtiff-debugsource | Feb 5, 2026 | Nov 11, 2025 |
| Suse | — | Upgrade tiffUpgrade libtiff-devel-32bitUpgrade libtiff5-32bitUpgrade libtiff-develUpgrade libtiff6-32bitUpgrade libtiff5Upgrade libtiff6 | Dec 5, 2025 | Oct 29, 2025 |
| Ubuntu | — | Upgrade libtiff-tools (Ubuntu Pro)Upgrade libtiff-toolsUpgrade libtiff5 (Ubuntu Pro)Upgrade libtiff6Upgrade libtiff5 | Aug 4, 2025 | Jul 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 16, 2025 | Jul 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub