CVE-2025-9900

Name	CVE-2025-9900
Description	A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4315-1, DSA-6023-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tiff (PTS)	bullseye	4.2.0-1+deb11u5	vulnerable
	bullseye (security)	4.2.0-1+deb11u7	fixed
	bookworm	4.5.0-6+deb12u2	vulnerable
	bookworm (security)	4.5.0-6+deb12u3	fixed
	trixie	4.7.0-3	vulnerable
	trixie (security)	4.7.0-3+deb13u1	fixed
	forky, sid	4.7.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
tiff	source	bullseye	4.2.0-1+deb11u7	DLA-4315-1
tiff	source	bookworm	4.5.0-6+deb12u3	DSA-6023-1
tiff	source	trixie	4.7.0-3+deb13u1	DSA-6023-1
tiff	source	(unstable)	4.7.1-1

Notes

https://gitlab.com/libtiff/libtiff/-/issues/704
https://gitlab.com/libtiff/libtiff/-/merge_requests/732
https://gitlab.com/libtiff/libtiff/-/commit/3e0dcf0ec651638b2bd849b2e6f3124b36890d99 (v4.7.1rc1)