A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.
CVSS Details
- CVSS 4.0 Base Score: 1.9 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libtiffUpgrade mingw64-libtiff-staticUpgrade mingw64-libtiffUpgrade mingw32-libtiffUpgrade mingw32-libtiff-staticUpgrade libtiff-develUpgrade libtiff-tools | Oct 29, 2025 | Oct 27, 2025 |
| Amazon Linux Ami 2 | — | Upgrade libtiff-toolsUpgrade libtiff-develUpgrade libtiff-debuginfoUpgrade libtiff-staticUpgrade libtiff | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libtiff-debuginfoUpgrade libtiff-develUpgrade libtiffUpgrade libtiff-tools-debuginfoUpgrade libtiff-debugsourceUpgrade libtiff-staticUpgrade libtiff-tools | Sep 9, 2025 | Jul 26, 2025 |
| Debian | — | No solution exists | Jul 28, 2025 | Jul 28, 2025 |
| Oracle_linux | — | Upgrade libtiff-develUpgrade mingw32-libtiffUpgrade mingw64-libtiff-staticUpgrade libtiff-toolsUpgrade mingw64-libtiffUpgrade libtiffUpgrade libtiff-staticUpgrade mingw32-libtiff-static | Oct 29, 2025 | Jul 26, 2025 |
| Redhat_linux | — | Upgrade libtiff-debugsourceUpgrade mingw32-libtiffUpgrade libtiff-tools-debuginfoUpgrade mingw64-libtiff-debuginfoUpgrade libtiff-toolsUpgrade mingw32-libtiff-staticUpgrade libtiffUpgrade libtiff-staticUpgrade libtiff-debuginfoUpgrade mingw64-libtiffUpgrade mingw32-libtiff-debuginfoUpgrade mingw64-libtiff-staticUpgrade libtiff-devel | Jul 31, 2025 | Jul 26, 2025 |
| Rocky_linux | — | Upgrade libtiff-debugsourceUpgrade libtiffUpgrade libtiff-develUpgrade libtiff-tools-debuginfoUpgrade libtiff-debuginfoUpgrade libtiff-tools | Feb 5, 2026 | Nov 11, 2025 |
| Suse | — | Upgrade libtiff5Upgrade libtiff6-32bitUpgrade libtiff5-32bitUpgrade libtiff-develUpgrade libtiff6Upgrade tiffUpgrade libtiff-devel-32bit | Dec 5, 2025 | Oct 29, 2025 |
| Ubuntu | — | Upgrade libtiff-tools (Ubuntu Pro)Upgrade libtiff6Upgrade libtiff5 (Ubuntu Pro)Upgrade libtiff-toolsUpgrade libtiff5 | Aug 4, 2025 | Jul 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 16, 2025 | Jul 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub