Red Hat Security Advisory

RHSA-2026:7504

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-04-10 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images libtiff-4.7.1-2.1.hum1@aarch64, libtiff-4.7.1-2.1.hum1@src, libtiff-4.7.1-2.1.hum1@x86_64 +6

TI-2025-09085 CVE-2025-9900 · GHSA-qc8j-wvjf-7jfj

HIGH 73

A flaw was found in Libtiff.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01005 Published 2025-09-23 Partial fix · 4.7.1, 4.6.0-6.el10_0.1 +30 CWE-123

TI-2025-37934 CVE-2025-61144 · GHSA-m6xw-mq4p-x7xv

MEDIUM 49

libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00303 Published 2026-02-23 Partial fix CWE-119

TI-2025-37935 CVE-2025-61145 · GHSA-5jj2-qhxw-rpq6

LOW 24

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00157 Published 2026-02-23 Partial fix CWE-415

TI-2025-37933 CVE-2025-61143 · GHSA-p884-v7p5-5858

LOW 24

libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00136 Published 2026-02-23 Partial fix CWE-476