Read the docs
TI-2025-07481 Aliases CVE-2025-8176GHSA-gvgc-3ch5-px8p

LibTIFF tiffmedian.c get_histogram use after free

Priority MEDIUM 55CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00287 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Red Hat: 17 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—LibTIFF4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7.0—No fix listedCNA
  • LibTIFF Vendor— Affected 4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*up to 4.7.0Vulnerablelibtiff
  • cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:* Versions up to 4.7.0 Vulnerable ·libtiff

Remediation

Red Hat 17 advisories

  • RHSA-2026:3462 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:3461 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:0077 Released 2026-01-05 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) spice-client-win-8.10-3.el8_4.1, spice-client-win-x64-8.10-3.el8_4.1, spice-client-win-x86-8.10-3.el8_4.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) spice-client-win-8.10-3.el8_4.1, spice-client-win-x64-8.10-3.el8_4.1, spice-client-win-x86-8.10-3.el8_4.1
Show 14 more Red Hat advisories
  • RHSA-2026:0076 Released 2026-01-05 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) spice-client-win-8.10-3.el8_6.1, spice-client-win-x64-8.10-3.el8_6.1, spice-client-win-x86-8.10-3.el8_6.1
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) spice-client-win-8.10-3.el8_6.1, spice-client-win-x64-8.10-3.el8_6.1, spice-client-win-x86-8.10-3.el8_6.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) spice-client-win-8.10-3.el8_6.1, spice-client-win-x64-8.10-3.el8_6.1, spice-client-win-x86-8.10-3.el8_6.1
  • RHSA-2026:0078 Released 2026-01-05 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) spice-client-win-8.10-3.el8_2.1, spice-client-win-x64-8.10-3.el8_2.1, spice-client-win-x86-8.10-3.el8_2.1
  • RHSA-2026:0001 Released 2026-01-05 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) spice-client-win-8.10-3.el8_8.1, spice-client-win-x64-8.10-3.el8_8.1, spice-client-win-x86-8.10-3.el8_8.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) spice-client-win-8.10-3.el8_8.1, spice-client-win-x64-8.10-3.el8_8.1, spice-client-win-x86-8.10-3.el8_8.1
  • RHSA-2025:23080 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2025:23079 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23078 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2025:21994 Released 2025-11-24 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2025:21507 Released 2025-11-17 · Red Hat rating Important
    libtiff security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) libtiff-tools-4.4.0-12.el9_4.4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libtiff-4.4.0-12.el9_4.4, libtiff-devel-4.4.0-12.el9_4.4
  • RHSA-2025:21508 Released 2025-11-17 · Red Hat rating Important
    libtiff security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libtiff-4.4.0-8.el9_2.4, libtiff-devel-4.4.0-8.el9_2.4
  • RHSA-2025:21407 Released 2025-11-17 · Red Hat rating Important
    libtiff security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libtiff-4.0.3-35.el7_9.1, libtiff-4.0.3-35.el7_9.1.ppc
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) libtiff-static-4.0.3-35.el7_9.1, libtiff-static-4.0.3-35.el7_9.1.ppc, libtiff-tools-4.0.3-35.el7_9.1
  • RHSA-2025:20956 Released 2025-11-11 · Red Hat rating Important
    libtiff security update
    • Red Hat Enterprise Linux AppStream (v. 9) libtiff-4.4.0-15.el9_7.2, libtiff-devel-4.4.0-15.el9_7.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libtiff-tools-4.4.0-15.el9_7.2
  • RHSA-2025:20034 Released 2025-11-10 · Red Hat rating Important
    libtiff security update
    • Red Hat Enterprise Linux AppStream (v. 8) libtiff-4.0.9-36.el8_10, libtiff-devel-4.0.9-36.el8_10
    • Red Hat Enterprise Linux CRB (v. 8) libtiff-tools-4.0.9-36.el8_10
  • RHSA-2025:19906 Released 2025-11-06 · Red Hat rating Important
    mingw-libtiff security update
    • Red Hat Enterprise Linux CRB (v. 8) mingw-libtiff-4.0.9-3.el8_10, mingw32-libtiff-4.0.9-3.el8_10, mingw32-libtiff-static-4.0.9-3.el8_10 +2
  • RHSA-2025:19113 Released 2025-10-28 · Red Hat rating Important
    libtiff security update
    • Red Hat Enterprise Linux AppStream (v. 9) libtiff-4.4.0-13.el9_6.2, libtiff-devel-4.4.0-13.el9_6.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libtiff-tools-4.4.0-13.el9_6.2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference Server 3.2Fixed RHSA-2025:23078, RHSA-2025:23079, RHSA-2025:23080, RHSA-2026:3461, RHSA-2026:3462
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2025:21507
Red Hat Discovery 2Fixed RHSA-2025:21994
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:20034
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:19113, RHSA-2025:20956
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:0078
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:0077
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:0076
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:0076
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:0001
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:21508
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:21507
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:0077
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:0076
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:0001
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2025:19906, RHSA-2025:20034
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:19113, RHSA-2025:20956
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2025:21407
Not affected: 7 products
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux Server (v. 7 ELS)
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-8176
  2. 2026-10-03 Alias added: GHSA-gvgc-3ch5-px8p

References

Exploit 1

Patch 2

Other 1

  • TI-2023-28739 Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service CVSS 3.1HIGH 7.5
  • TI-2023-10746 libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215. CVSS 3.1HIGH 8.8
  • TI-2022-03639 LibTIFF tif_getimage.c TIFFReadRGBATileExt integer overflow CVSS 3.1HIGH 8.8
  • TI-2023-05765 Libtiff: out-of-memory in tiffopen via a craft file CVSS 3.1MEDIUM 6.5
  • TI-2022-03286 Out-of-bounds write in libtiff CVSS 3.1HIGH 7.7
  • TI-2006-03352 Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used… CVSS 2.0HIGH 7.5
See all 261 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences