CVE-2025-8534 — Improper Resource Shutdown or Release

Vendor	Product	Version range	Fixed in
debian	tiff	< tiff 4.7.1-1 (forky)	tiff 4.7.1-1 (forky)
libtiff	libtiff	—	—
msrc	azl3_libtiff_4.6.0-7_on_azure_linux_3.0	—	—
msrc	cbl2_libtiff_4.6.0-6_on_cbl_mariner_2.0	—	—
msrc	cbl2_libtiff_4.6.0-8_on_cbl_mariner_2.0	—	—

OSV

tiff vulnerabilities

osv·2025-08-20·CVSS 4.8

CVE-2025-8176 [MEDIUM] tiff vulnerabilities tiff vulnerabilities It was discovered that LibTIFF incorrectly handled certain memory operations when using tiffmedian tool. An attacker could trick a user into processing a specially crafted tiff image file and potentially use this issue to cause a denial of service. (CVE-2025-8176) It was discovered that LibTIFF did not properly perform bounds checking in certain operations when using thumbnail tool. An attacker could trick a user into processing a specially crafted tiff image file and potentially use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2025-8177) It was discovered that LibTIFF incorrectly handled certain memory operations when using tiff2ps tool. An attacker could trick a user into processing a specially craft

GHSA

GHSA-xgh3-993q-r2x8: A vulnerability classified as problematic was found in libtiff 4

ghsa_unreviewed·2025-08-05

CVE-2025-8534 [LOW] CWE-404 GHSA-xgh3-993q-r2x8: A vulnerability classified as problematic was found in libtiff 4 A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used."

OSV

CVE-2025-8534: A vulnerability classified as problematic was found in libtiff 4

osv·2025-08-05·CVSS 2.0

CVE-2025-8534 [LOW] CVE-2025-8534: A vulnerability classified as problematic was found in libtiff 4 A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used."

Ubuntu

LibTIFF vulnerabilities

vendor_ubuntu·2025-08-20·CVSS 5.3

CVE-2025-8176 [MEDIUM] LibTIFF vulnerabilities Title: LibTIFF vulnerabilities Summary: Several security issues were fixed in LibTIFF. It was discovered that LibTIFF incorrectly handled certain memory operations when using tiffmedian tool. An attacker could trick a user into processing a specially crafted tiff image file and potentially use this issue to cause a denial of service. (CVE-2025-8176) It was discovered that LibTIFF did not properly perform bounds checking in certain operations when using thumbnail tool. An attacker could trick a user into processing a specially crafted tiff image file and potentially use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2025-8177) It was discovered that LibTIFF incorrectly handled certain memory operations when using tiff2ps too

Microsoft

libtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference

vendor_msrc·2025-08-12·CVSS 2.5

CVE-2025-8534 [LOW] CWE-476 libtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference libtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this. Mariner: Mariner VulDB: VulDB Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https:

Red Hat

libtiff: Libtiff Null Pointer Dereference Vulnerability

vendor_redhat·2025-08-04·CVSS 2.0

CVE-2025-8534 [LOW] CWE-476 libtiff: Libtiff Null Pointer Dereference Vulnerability libtiff: Libtiff Null Pointer Dereference Vulnerability A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used." A flaw was found in libtiff. The `PS_L

Debian

CVE-2025-8534: tiff - A vulnerability classified as problematic was found in libtiff 4.6.0. This vulne...

vendor_debian·2025·CVSS 2.0

CVE-2025-8534 [LOW] CVE-2025-8534: tiff - A vulnerability classified as problematic was found in libtiff 4.6.0. This vulne... A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used." Scope: local bookworm: open bullseye: open forky: resolved (fixed in 4.7.1-1) sid: resolved (fix

CVE-2025-8534: A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the…

Affected

CVSS provenance