Skip to main content

Libtiff CVE-2025-61143

MEDIUM
NULL Pointer Dereference (CWE-476)
2026-02-23 cve@mitre.org
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Patch released
Mar 23, 2026 - 14:45 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
CVE Published
Feb 23, 2026 - 19:22 nvd
MEDIUM 5.5

DescriptionCVE.org

libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.

AnalysisAI

libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c. [CVSS 5.5 MEDIUM]

Technical ContextAI

Classified as CWE-476 (NULL Pointer Dereference). Affects the the component of Libtiff. libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.

RemediationAI

Monitor vendor advisories for a patch.

CVE-2012-4564 MEDIUM POC
6.8 Nov 11

ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a deni

CVE-2015-8668 CRITICAL POC
9.8 Jan 08

Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier

CVE-2015-7554 CRITICAL POC
9.8 Jan 08

The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory

CVE-2016-9534 CRITICAL POC
9.8 Nov 22

tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc and

CVE-2017-17095 HIGH POC
8.8 Dec 02

tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-b

CVE-2016-8331 HIGH POC
8.1 Oct 28

An exploitable remote code execution vulnerability exists in the handling of TIFF images in LibTIFF version 4.0.6. Rated

CVE-2017-5225 HIGH POC
8.8 Jan 12

LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via

CVE-2017-17973 HIGH POC
8.8 Dec 29

In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. Rated high severity

CVE-2017-9935 HIGH POC
8.8 Jun 26

In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. Rated high se

CVE-2017-17942 HIGH POC
8.8 Dec 28

In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c. Rated high se

CVE-2023-25434 HIGH POC
8.8 Jun 14

libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215. Rated

CVE-2022-3970 HIGH POC
8.8 Nov 13

A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Micro 5.2 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

CVE-2025-61143 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy