CVE-2025-8176
📋 TL;DR
A critical use-after-free vulnerability in LibTIFF's tiffmedian tool allows local attackers to execute arbitrary code or cause denial of service. This affects systems running vulnerable versions of LibTIFF (up to 4.7.0) where the tiffmedian tool is accessible. The vulnerability requires local access to exploit.
💻 Affected Systems
- LibTIFF
📦 What is this software?
Libtiff by Libtiff
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, arbitrary code execution as the user running tiffmedian, or complete system crash.
Likely Case
Application crash (denial of service) when processing malicious TIFF files with tiffmedian, potentially allowing limited code execution in the context of the running process.
If Mitigated
No impact if tiffmedian tool is not used or if proper access controls prevent local users from executing it.
🎯 Exploit Status
Exploit requires local access to execute tiffmedian with a malicious TIFF file. The vulnerability is in a command-line tool, not the library itself when used by other applications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit fe10872e53efba9cc36c66ac4ab3b41a839d5172
Vendor Advisory: https://gitlab.com/libtiff/libtiff/-/issues/707
Restart Required: No
Instructions:
1. Update LibTIFF to version 4.7.1 or later. 2. Apply patch fe10872e53efba9cc36c66ac4ab3b41a839d5172 if compiling from source. 3. For package managers: 'sudo apt update && sudo apt upgrade libtiff5' (Debian/Ubuntu) or 'sudo yum update libtiff' (RHEL/CentOS).
🔧 Temporary Workarounds
Remove tiffmedian binary
linuxRemove or restrict execute permissions on the tiffmedian tool if not needed
sudo rm /usr/bin/tiffmedian
sudo chmod 000 /usr/bin/tiffmedian
Restrict user access
linuxUse SELinux/AppArmor or file permissions to restrict which users can execute tiffmedian
sudo chmod 750 /usr/bin/tiffmedian
sudo chown root:trustedgroup /usr/bin/tiffmedian
🧯 If You Can't Patch
- Remove execute permissions from tiffmedian binary or uninstall the tiffmedian package
- Implement strict access controls to prevent unauthorized users from executing tiffmedian
🔍 How to Verify
Check if Vulnerable:
Check if tiffmedian exists and LibTIFF version: 'which tiffmedian && tiffmedian --version | head -1'Check Version:
tiffmedian --version | head -1Verify Fix Applied:
Verify LibTIFF version is >4.7.0 or check if commit fe10872e is present in source: 'tiffmedian --version | grep -q "4.7.1" && echo "Patched"'📡 Detection & Monitoring
Log Indicators:
- Failed tiffmedian executions
- Process crashes of tiffmedian
- Unusual tiffmedian usage patterns
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Process Creation where Image contains 'tiffmedian' OR Process Crash where ProcessName contains 'tiffmedian'🔗 References
- http://www.libtiff.org/
- https://gitlab.com/libtiff/libtiff/-/commit/fe10872e53efba9cc36c66ac4ab3b41a839d5172
- https://gitlab.com/libtiff/libtiff/-/issues/707
- https://gitlab.com/libtiff/libtiff/-/merge_requests/727
- https://vuldb.com/?ctiid.317590
- https://vuldb.com/?id.317590
- https://vuldb.com/?submit.621796
