PT-2025-33266 · Libtiff+6 · Libtiff+6

Ucas-Xd · Published 2025-08-14 · Updated 2026-03-31 · CVE-2025-8961

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: LibTIFF version 4.7.0

Description: A memory corruption issue was identified in the tiffcrop.c component, specifically within the May function. The issue can be triggered locally. The exploit has been publicly disclosed.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2025-11954

ALT-PU-2025-11987

ALT-PU-2025-11989

ALT-PU-2025-12059

AZL-66423

AZL-66426

BDU:2025-13924

CVE-2025-8961

ECHO-EBC5-0965-EA5C

MGASA-2025-0252

OPENSUSE-SU-2025:15541-1

OPENSUSE-SU-2025:20049-1

SUSE-SU-2025:03345-1

SUSE-SU-2025:03346-1

SUSE-SU-2025:03348-1

SUSE-SU-2025:20971-1

SUSE-SU-2025:21009-1

SUSE-SU-2025:21032-1

SUSE-SU-2025:21037-1

SUSE-SU-2025_03345-1

SUSE-SU-2025_03346-1

SUSE-SU-2025_03348-1

USN-7783-1

Affected Products

Alt Linux

Debian

Libtiff

Linuxmint

Red Os

Suse

Ubuntu

References · 79

• 🔥 https://drive.google.com/file/d/15L4q2eD8GX3Aj3z6SWC3_FbqaM1ChUx2/view?usp=sharing · Exploit
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE350 · Vendor Advisory
• https://gitlab.com/libtiff/libtiff/-/issues/721 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-8961 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7783-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03348-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0252 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:21037-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7783-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8961 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:20971-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-66423 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-9165 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:20049-1 · Vendor Advisory