Description
A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | LibTIFF | 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 4.7.1-1 | — |
| Debian 13 | tiff | No fix yet | — |
| Debian 12 | tiff | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | tiff | 4.5.1+git230720-4ubuntu2.3 | USN-7707-1 |
| Ubuntu 22.04 LTS | tiff | 4.3.0-6ubuntu0.11 | USN-7707-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | tiff | 4.1.0+git191117-2ubuntu0.20.04.14+esm1 | USN-7707-1 |
| Ubuntu Pro 18.04 LTS | tiff | 4.0.9-5ubuntu0.10+esm8 | USN-7707-1 |
| Ubuntu Pro 16.04 LTS | tiff | 4.0.6-1ubuntu0.8+esm18 | USN-7707-1 |
| Ubuntu Pro 14.04 LTS | tiff | 4.0.3-7ubuntu0.11+esm15 | USN-7707-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | libtiff +2 | 4.4.0-13.el9_6.2 | RHSA-2025:20956, RHSA-2025:19113 |
| RHEL 8 | libtiff +2 | 4.0.9-36.el8_10 | RHSA-2025:20034 |
| RHEL 8 | mingw-libtiff +4 | 4.0.9-3.el8_10 | RHSA-2025:19906 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | libtiff +2 | 4.4.0-12.el9_4.4 | RHSA-2025:21507 |
| RHEL 9.2 E4S | libtiff +1 | 4.4.0-8.el9_2.4 | RHSA-2025:21508 |
| RHEL 8.8 TUS | spice-client-win +2 | 8.10-3.el8_8.1 | RHSA-2026:0001 |
| RHEL 8.8 E4S | spice-client-win +2 | 8.10-3.el8_8.1 | RHSA-2026:0001 |
| RHEL 8.6 TUS | spice-client-win +2 | 8.10-3.el8_6.1 | RHSA-2026:0076 |
| RHEL 8.6 E4S | spice-client-win +2 | 8.10-3.el8_6.1 | RHSA-2026:0076 |
| RHEL 8.6 AUS | spice-client-win +2 | 8.10-3.el8_6.1 | RHSA-2026:0076 |
| RHEL 8.4 EUS Long Life | spice-client-win +2 | 8.10-3.el8_4.1 | RHSA-2026:0077 |
| RHEL 8.4 AUS | spice-client-win +2 | 8.10-3.el8_4.1 | RHSA-2026:0077 |
| RHEL 8.2 AUS | spice-client-win +2 | 8.10-3.el8_2.1 | RHSA-2026:0078 |
| RHEL 7 ELS | libtiff +2 | 4.0.3-35.el7_9.1 | RHSA-2025:21407 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | libtiff +2 | 4.4.0-13.el9_6.2 | ALSA-2025:20956, ALSA-2025:19113 |
| AlmaLinux 8 | libtiff +2 | 4.0.9-36.el8_10 | ALSA-2025:20034 |
| AlmaLinux 8 | mingw32-libtiff +3 | 4.0.9-3.el8_10 | ALSA-2025:19906 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | libtiff | 4.4.0-13.el9_6.2 | RLSA-2025:20956, RLSA-2025:19113 |
| Rocky Linux 8 | libtiff | 4.0.9-36.el8_10 | RLSA-2025:20034 |
| Rocky Linux 8 | mingw-libtiff | 4.0.9-3.el8_10 | RLSA-2025:19906 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1, SUSE-SU-2025:02770-1 |
| SLES 15 SP6 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1, SUSE-SU-2025:02770-1 |
| SLES 15 SP5 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SLES 15 SP4 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SLES 15 SP3 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
Show 19 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | tiff | 4.0.9-44.89.1 | SUSE-SU-2025:02771-1 |
| SLES for SAP 16.0 | tiff | 4.7.1-160000.1.1 | SUSE-SU-2025:21009-1 |
| SLES for SAP 15 SP5 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SLES for SAP 15 SP4 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SLES for SAP 15 SP3 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SLES 16.0 | tiff | 4.7.1-160000.1.1 | SUSE-SU-2025:21009-1 |
| SLE Micro 6.2 | tiff | 4.7.1-160000.1.1 | SUSE-SU-2025:21032-1 |
| SLE Micro 6.1 | tiff | 4.7.1-slfo.1.1_1.1 | SUSE-SU-2025:20971-1 |
| SLE Micro 6.0 | tiff | 4.7.1-1.1 | SUSE-SU-2025:21037-1 |
| SLE Micro 5.5 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SLE Micro 5.4 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SLE Micro 5.3 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SLE Micro 5.2 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SLE HPC 15 SP5 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SLE HPC 15 SP4 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SLE HPC 15 SP3 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SUSE Manager Server LTS 4.3 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SUSE Manager Proxy LTS 4.3 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
| SUSE Enterprise Storage 7.1 | tiff | 4.0.9-150000.45.50.1 | SUSE-SU-2025:02815-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tiff | 4.7.0-7.1 | openSUSE-SU-2025:15417-1 |
| openSUSE Leap 16.0 | tiff +1 | 4.7.1-160000.1.1 | openSUSE-SU-2025:20049-1 |
| openSUSE Leap 15.6 | tiff | 4.7.0-150600.3.13.1 | SUSE-SU-2025:02770-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libtiff +3 | 4.4.0-4.amzn2023.0.20 | ALAS2023-2025-1153 |
| Amazon Linux 2 | libtiff +3 | 4.0.3-35.amzn2.0.23 | ALAS2-2025-2965 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libtiff | 4.6.0-7 | — |
| Azure Linux 2 (CBL-Mariner) | libtiff | 4.6.0-8 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | libtiff +2 | 4.4.0-13.el9_6.2 | ELSA-2025-20956, ELSA-2025-19113 |
| Oracle Linux 8 | mingw32-libtiff +3 | 4.0.9-3.el8_10 | ELSA-2025-19906 |
| Oracle Linux 7 | libtiff +3 | 4.0.3-35.0.1.el7 | ELSA-2025-21407 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | tiff | 4.7.0-r6 | — |
Advisories 37
- ALSA-2025:19113 Important: libtiff security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:20956 Important: libtiff security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:19906 Important: mingw-libtiff security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:20034 Important: libtiff security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:0078 Red Hat Security Advisory: spice-client-win security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:0077 Red Hat Security Advisory: spice-client-win security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:0076 Red Hat Security Advisory: spice-client-win security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:0001 Red Hat Security Advisory: spice-client-win security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:21407 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- WID-SEC-2026-1730 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 16, 2026
- RHSA-2025:21508 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:21507 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:20956 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:20034 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:19906 Red Hat Security Advisory: mingw-libtiff security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:19113 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- USN-7707-1 tiff vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- RLSA-2025:20956 Important: libtiff security update Rocky Linux Security Advisories · May 21, 2026
- openSUSE-SU-2025:20049-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15417-1 libtiff-devel-32bit-4.7.0-7.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21009-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20971-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21037-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02815-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02770-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02771-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21032-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-1654 libTIFF (Tiffmedian, Thumbnail): Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 1, 2026
- ELSA-2025-21407 Important: libtiff security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 1, 2025
- ELSA-2025-20956 Important: libtiff security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 25, 2025
- RLSA-2025:20034 Important: libtiff security update Rocky Linux Security Advisories · Nov 11, 2025
- RLSA-2025:19906 Important: mingw-libtiff security update Rocky Linux Security Advisories · Nov 7, 2025
- ELSA-2025-19906 Important: mingw-libtiff security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 7, 2025
- RLSA-2025:19113 Important: libtiff security update Rocky Linux Security Advisories · Nov 6, 2025
- ELSA-2025-19113 Important: libtiff security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 28, 2025
- ALAS2023-2025-1153 Moderate: libtiff security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 8, 2025
- ALAS2-2025-2965 Moderate: libtiff security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 19, 2025
References
- VDB-317590 | LibTIFF tiffmedian.c get_histogram use after free vdb-entry technical-description
- VDB-317590 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #621796 | LibTIFF v4.7.0 Use After Free third-party-advisory
- https://gitlab.com/libtiff/libtiff/-/issues/707 exploit issue-tracking
- https://gitlab.com/libtiff/libtiff/-/merge_requests/727 patch
- https://gitlab.com/libtiff/libtiff/-/commit/fe10872e53efba9cc36c66ac4ab3b41a839d5172 patch
- http://www.libtiff.org/ product