8.8

CVE-2025-9900: tiff Write-what-where Condition

CVSS: 8.8v3.1HighDeferred
AliasesSUSE-SU-2025:3941-1SUSE-SU-2025:3961-1RHSA-2025:17651
Published 23-09-2025Last modified 29-06-2026
Open JSON

Vulnerability summary

CVE-2025-9900 is a high (CVSS 8.8) Write-what-where Condition vulnerability in tiff. EPSS estimates a 0.97% chance of exploitation in the next 30 days, higher than 61.2% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.97%
0%100%
Low · +0.18 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 20 · Related 10
DLA-4315-1MGASA-2025-0252OPENSUSE-SU-2025:20049-1RHSA-2025:19113RHSA-2025:19906RHSA-2025:20956

Timeline

  1. 23-09-2025
    PublishedVulnerability first disclosed.
  2. 29-06-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.97%

Chance of exploitation in the next 30 days

Percentile

61%

Versus all other CVEs

30-day change

+0.18 pp

From 0.79% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.97%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse22 products
  • tiff&distro=SUSE Enterprise Storage 7.1< 4.0.9-150000.45.60.1
  • tiff&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 4.0.9-150000.45.60.1
  • tiff&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 4.0.9-150000.45.60.1
  • tiff&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 4.0.9-150000.45.60.1
  • tiff&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 4.0.9-150000.45.60.1
Redhat9 products
  • compat-libtiff3< 0:3.9.4-13.el8_4.1 | < 0:3.9.4-14.el8_10 | < 0:3.9.4-12.el7_9.1 | < 0:3.9.4-13.el8_2.1 | < 0:3.9.4-13.el8_6.1 | < 0:3.9.4-13.el8_8.1
  • compat-libtiff3-debuginfo< 0:3.9.4-14.el8_10
  • compat-libtiff3-debugsource< 0:3.9.4-14.el8_10
  • libtiff< 0:4.6.0-6.el10_0.1 | < 0:4.0.9-35.el8_10 | < 0:4.2.0-3.el9_0.2 | < 0:4.0.9-29.el8_8.1 | < 0:4.6.0-6.el10_1.1 | < 0:4.0.9-21.el8_6.1 | < 0:4.0.9-18.el8_4.1 | < 0:4.0.9-17.el8_2.1
  • libtiff-debuginfo< 0:4.6.0-6.el10_0.1 | < 0:4.0.9-35.el8_10 | < 0:4.2.0-3.el9_0.2 | < 0:4.0.9-29.el8_8.1 | < 0:4.6.0-6.el10_1.1 | < 0:4.0.9-21.el8_6.1 | < 0:4.0.9-18.el8_4.1 | < 0:4.0.9-17.el8_2.1
Ubuntu4 products
  • gdal< 1.10.1+dfsg-5ubuntu1+esm2 | < 1.11.3+dfsg-3ubuntu0.1~esm1
  • qtwebengine-opensource-src< 5.9.5+dfsg-0ubuntu2+esm1 | < 5.12.8+dfsg-0ubuntu1.1+esm1 | < 5.15.9+dfsg-1ubuntu0.1~esm1 | < 5.15.16+dfsg-3ubuntu0.1~esm1 | All versions (No fix recorded) | < 5.15.19+dfsg2-4ubuntu0.1~esm1
  • texmaker< 5.0.2-1ubuntu0.1~esm1 | < 5.0.3-1ubuntu0.20.04.1~esm1 | < 5.0.3-1ubuntu0.22.04.1~esm1 | < 5.1.3+dfsg-1ubuntu0.1~esm1 | All versions (No fix recorded)
  • tiff< 4.0.3-7ubuntu0.11+esm16 | < 4.0.6-1ubuntu0.8+esm19 | < 4.0.9-5ubuntu0.10+esm9 | < 4.1.0+git191117-2ubuntu0.20.04.14+esm2 | < 4.3.0-6ubuntu0.12 | < 4.5.1+git230720-4ubuntu2.4 | < 4.7.0-3ubuntu3
Debian1 product
  • tiff< 4.7.1-1 | < 4.5.0-6+deb12u3 | < 4.7.0-3+deb13u1
Opensuse1 product
  • tiff&distro=openSUSE Tumbleweed< 4.7.1-2.1

5 vendors · 37 products

References

67 links
Show all 67 references