LibTIFF CVE-2025-8176

Exploitation requires: (1) local command-line access to the affected system (AV:L), (2) authenticated user account with execution privileges (PR:L), (3) ability to supply a malformed TIFF file to the tiffmedian utility or an application that uses the vulnerable get_histogram function internally, and (4) the vulnerable LibTIFF version (up to 4.7.0) must be installed and active. The attack does not require user interaction beyond normal tool invocation (UI:N). Systems where LibTIFF is only used as a backend library (not via direct tiffmedian command-line tool) remain vulnerable if the application exposes TIFF processing to local users. Systems running patched versions, versions after 4.7.0, or deployments where local users lack execution permissions on TIFF processing utilities are not affected.

This vulnerability presents a significant discrepancy between declared severity and real-world exploitability. The CVSS 4.0 vector (AV:L/AC:L/PR:L) correctly identifies local-only access with low attack complexity but authenticated privileges required (PR:L), limiting exposure to users with local shell access to an affected system. The impact scope is confined (VC:L/VI:L/VA:L with no scope change), producing a CVSS score of 1.9 - legitimately low. However, EPSS at 0.03% (7th percentile) indicates minimal real-world exploitation probability despite publicly available POC code, suggesting the exploit either requires specific conditions, works against outdated versions, or has limited practical utility beyond denial of service. The declaration as 'critical' by the source appears inconsistent with CVSS and EPSS data; this may reflect conservative library maintainer standards or the presence of use-after-free in memory-critical code. For organizations embedding LibTIFF in user-facing applications processing untrusted TIFF files, the local authentication requirement significantly reduces risk compared to network-exposed vulnerabilities. Patch availability and low attack complexity favor rapid remediation.

An authenticated local user with shell access to a system running a vulnerable LibTIFF version processes a specially crafted TIFF file using the tiffmedian utility, triggering the use-after-free condition in get_histogram. Depending on heap state, this could cause a denial of service crash (most likely outcome given CVSS impact scores) or, with precise heap spray techniques, potentially leak sensitive data from process memory. The public exploit code referenced in GitLab issue #707 likely demonstrates the crash condition; achieving reliable code execution would require additional heap manipulation not confirmed in available reports.