A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.
CVSS Details
- CVSS 4.0 Base Score: 1.9 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libtiff-develUpgrade mingw32-libtiffUpgrade mingw32-libtiff-staticUpgrade libtiff-toolsUpgrade mingw64-libtiffUpgrade libtiffUpgrade mingw64-libtiff-static | Oct 29, 2025 | Oct 27, 2025 |
| Amazon Linux Ami 2 | — | Upgrade libtiff-toolsUpgrade libtiff-develUpgrade libtiff-debuginfoUpgrade libtiff-staticUpgrade libtiff | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libtiff-develUpgrade libtiffUpgrade libtiff-tools-debuginfoUpgrade libtiff-debugsourceUpgrade libtiff-debuginfoUpgrade libtiff-toolsUpgrade libtiff-static | Sep 9, 2025 | Jul 26, 2025 |
| Debian | — | No solution exists | Jul 28, 2025 | Jul 28, 2025 |
| Oracle_linux | — | Upgrade libtiffUpgrade libtiff-toolsUpgrade mingw32-libtiff-staticUpgrade libtiff-staticUpgrade mingw64-libtiffUpgrade libtiff-develUpgrade mingw64-libtiff-staticUpgrade mingw32-libtiff | Oct 29, 2025 | Jul 26, 2025 |
| Redhat_linux | — | Upgrade libtiff-develUpgrade mingw32-libtiff-debuginfoUpgrade libtiff-debuginfoUpgrade libtiff-staticUpgrade libtiffUpgrade mingw64-libtiff-staticUpgrade mingw64-libtiffUpgrade libtiff-debugsourceUpgrade mingw64-libtiff-debuginfoUpgrade mingw32-libtiff-staticUpgrade libtiff-tools-debuginfoUpgrade mingw32-libtiffUpgrade libtiff-tools | Jul 31, 2025 | Jul 26, 2025 |
| Rocky_linux | — | Upgrade libtiff-debuginfoUpgrade libtiff-toolsUpgrade libtiffUpgrade libtiff-develUpgrade libtiff-tools-debuginfoUpgrade libtiff-debugsource | Feb 5, 2026 | Nov 11, 2025 |
| Suse | — | Upgrade libtiff6-32bitUpgrade libtiff5-32bitUpgrade libtiff-develUpgrade libtiff6Upgrade libtiff5Upgrade libtiff-devel-32bitUpgrade tiff | Dec 5, 2025 | Oct 29, 2025 |
| Ubuntu | — | Upgrade libtiff5 (Ubuntu Pro)Upgrade libtiff-toolsUpgrade libtiff6Upgrade libtiff5Upgrade libtiff-tools (Ubuntu Pro) | Aug 4, 2025 | Jul 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 16, 2025 | Jul 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub