CVE-2025-8851
📋 TL;DR
A stack-based buffer overflow vulnerability exists in LibTIFF's tiffcrop utility, specifically in the readSeparateStripsetoBuffer function. This vulnerability could allow local attackers to execute arbitrary code or cause denial of service. Users of LibTIFF up to version 4.5.1 are affected.
💻 Affected Systems
- LibTIFF
📦 What is this software?
Libtiff by Libtiff
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise via arbitrary code execution.
Likely Case
Application crash (denial of service) or limited code execution in the context of the tiffcrop process.
If Mitigated
Minimal impact if proper access controls prevent local attackers from running tiffcrop on vulnerable systems.
🎯 Exploit Status
Exploitation requires local access and ability to run tiffcrop with malicious TIFF files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: LibTIFF version after commit 8a7a48d7a645992ca83062b3a1873c951661e2b3
Vendor Advisory: http://www.libtiff.org/
Restart Required: No
Instructions:
1. Update LibTIFF to version after commit 8a7a48d7a645992ca83062b3a1873c951661e2b3. 2. Recompile applications using LibTIFF if statically linked. 3. For package managers: use system update commands (apt-get upgrade, yum update, etc.) for libtiff packages.
🔧 Temporary Workarounds
Restrict tiffcrop access
Unix/LinuxRemove execute permissions from tiffcrop binary for non-privileged users
chmod 750 /usr/bin/tiffcrop
chown root:root /usr/bin/tiffcrop
🧯 If You Can't Patch
- Remove tiffcrop utility from production systems if not required
- Implement strict access controls to prevent unauthorized users from executing tiffcrop
🔍 How to Verify
Check if Vulnerable:
Check LibTIFF version: tiffcrop --version | grep 'Version'Check Version:
tiffcrop --version 2>/dev/null || echo 'tiffcrop not found'Verify Fix Applied:
Verify version is newer than 4.5.1 or check for commit 8a7a48d7a645992ca83062b3a1873c951661e2b3 in source📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from tiffcrop process
- Unexpected tiffcrop execution by non-privileged users
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
Process:Name='tiffcrop' AND EventType='Process Crash'