CVE-2025-9165

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue.

CVSS v3.0 3.3 LOW

3.3^/10

CVSS v3.0 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
http://www.libtiff.org/
https://drive.google.com/file/d/1FWhmkzksH8-qU0ZM6seBzGNB3aPnX3G8/view?usp=sharing
https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0
https://gitlab.com/libtiff/libtiff/-/issues/728
https://gitlab.com/libtiff/libtiff/-/merge_requests/747
https://vuldb.com/?ctiid.320543
https://vuldb.com/?id.320543
https://vuldb.com/?submit.630506
https://vuldb.com/?submit.630507

Configurations

No configuration.

History

19 Aug 2025, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-19 20:15

Updated : 2025-08-19 20:15

NVD link : CVE-2025-9165

Mitre link : CVE-2025-9165

JSON object : View

Products Affected

No product.

CWE

CWE-404

Improper Resource Shutdown or Release

CWE-401

Missing Release of Memory after Effective Lifetime

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.libtiff.org/", "name": "http://www.libtiff.org/", "tags": [], "refsource": ""}, {"url": "https://drive.google.com/file/d/1FWhmkzksH8-qU0ZM6seBzGNB3aPnX3G8/view?usp=sharing", "name": "https://drive.google.com/file/d/1FWhmkzksH8-qU0ZM6seBzGNB3aPnX3G8/view?usp=sharing", "tags": [], "refsource": ""}, {"url": "https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0", "name": "https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0", "tags": [], "refsource": ""}, {"url": "https://gitlab.com/libtiff/libtiff/-/issues/728", "name": "https://gitlab.com/libtiff/libtiff/-/issues/728", "tags": [], "refsource": ""}, {"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/747", "name": "https://gitlab.com/libtiff/libtiff/-/merge_requests/747", "tags": [], "refsource": ""}, {"url": "https://vuldb.com/?ctiid.320543", "name": "VDB-320543 | CTI Indicators (IOB, IOC, IOA)", "tags": [], "refsource": ""}, {"url": "https://vuldb.com/?id.320543", "name": "VDB-320543 | LibTIFF tiffcmp tiffcmp.c InitCCITTFax3 memory leak", "tags": [], "refsource": ""}, {"url": "https://vuldb.com/?submit.630506", "name": "Submit #630506 | libtiff tiffcmp 4.7.0+ (latest master branch) Memory Leak", "tags": [], "refsource": ""}, {"url": "https://vuldb.com/?submit.630507", "name": "Submit #630507 | libtiff tiffcmp 4.7.0+ (latest master branch) Memory Leak (Duplicate)", "tags": [], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-404"}, {"lang": "en", "value": "CWE-401"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2025-9165", "ASSIGNER": "cna@vuldb.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}}, "publishedDate": "2025-08-19T20:15Z", "configurations": {"nodes": [], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-08-19T20:15Z"}