A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.
CVSS Details
- CVSS 4.0 Base Score: 1.9 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mingw64-libtiff-staticUpgrade mingw64-libtiffUpgrade libtiffUpgrade libtiff-toolsUpgrade libtiff-develUpgrade mingw32-libtiffUpgrade mingw32-libtiff-static | Oct 29, 2025 | Oct 27, 2025 |
| Amazon Linux Ami 2 | — | Upgrade libtiff-develUpgrade libtiff-toolsUpgrade libtiff-debuginfoUpgrade libtiff-staticUpgrade libtiff | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libtiff-toolsUpgrade libtiff-staticUpgrade libtiff-tools-debuginfoUpgrade libtiff-debuginfoUpgrade libtiff-develUpgrade libtiff-debugsourceUpgrade libtiff | Sep 9, 2025 | Jul 26, 2025 |
| Debian | — | No solution exists | Jul 28, 2025 | Jul 28, 2025 |
| Oracle_linux | — | Upgrade mingw64-libtiffUpgrade mingw32-libtiff-staticUpgrade libtiff-toolsUpgrade libtiff-staticUpgrade libtiffUpgrade mingw64-libtiff-staticUpgrade libtiff-develUpgrade mingw32-libtiff | Oct 29, 2025 | Jul 26, 2025 |
| Redhat_linux | — | Upgrade libtiff-toolsUpgrade libtiff-tools-debuginfoUpgrade libtiff-debugsourceUpgrade mingw32-libtiff-staticUpgrade mingw64-libtiff-debuginfoUpgrade mingw32-libtiffUpgrade libtiff-develUpgrade libtiff-staticUpgrade mingw64-libtiffUpgrade libtiff-debuginfoUpgrade libtiffUpgrade mingw32-libtiff-debuginfoUpgrade mingw64-libtiff-static | Jul 31, 2025 | Jul 26, 2025 |
| Rocky_linux | — | Upgrade libtiffUpgrade libtiff-tools-debuginfoUpgrade libtiff-debugsourceUpgrade libtiff-develUpgrade libtiff-toolsUpgrade libtiff-debuginfo | Feb 5, 2026 | Nov 11, 2025 |
| Suse | — | Upgrade libtiff-develUpgrade libtiff6Upgrade libtiff6-32bitUpgrade libtiff5-32bitUpgrade libtiff5Upgrade tiffUpgrade libtiff-devel-32bit | Dec 5, 2025 | Oct 29, 2025 |
| Ubuntu | — | Upgrade libtiff6Upgrade libtiff-tools (Ubuntu Pro)Upgrade libtiff5 (Ubuntu Pro)Upgrade libtiff5Upgrade libtiff-tools | Aug 4, 2025 | Jul 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 16, 2025 | Jul 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub