CVE-2025-8961: libtiff
Vulnerability summary
CVE-2025-8961 is a medium (CVSS 4.8) vulnerability in libtiff. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.1% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 10 · Related 10Timeline
- 14-08-2025PublishedVulnerability first disclosed.
- 23-08-2025Last modifiedVulnerability information updated.
Description
A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.
CVSS metrics
13 scores · 7 sources · 4 versions- OSV · AlpineEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · DebianEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · ChainguardEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- NVDNIST1.9LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- NVDNIST3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- NVDNIST1.7LowAV:L/AC:L/Au:S/C:N/I:N/A:P
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
+0.01 pp
From 0.21% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (drive.google.com)
Maturity: unknown
Exploit Reference (gitlab.com)
Maturity: unknown
Exploit Reference (gitlab.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- tiff< 4.7.1-r0
Chainguard1 product
- tiff< 4.7.0-r6
Debian1 product
- tiffAll versions (No fix recorded) | < 4.7.0-3+deb13u1 | < 4.7.0-5
Libtiff1 product
- libtiff4.7.0
Opensuse1 product
- tiff&distro=openSUSE Tumbleweed< 4.7.0-9.1
Ubuntu1 product
- tiff< 4.0.3-7ubuntu0.11+esm16 | < 4.0.6-1ubuntu0.8+esm19 | < 4.0.9-5ubuntu0.10+esm9 | < 4.1.0+git191117-2ubuntu0.20.04.14+esm2 | < 4.3.0-6ubuntu0.12 | < 4.5.1+git230720-4ubuntu2.4 | < 4.7.0-3ubuntu3
Wolfi1 product
- tiff< 4.7.0-r6
7 vendors · 7 products
