CVE-2025-9165: LibTIFF tiffcmp tiffcmp.c InitCCITTFax3 memory leak
A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9165?
CVE-2025-9165 has been classified with a severity level indicating potential risk due to memory leak vulnerabilities.
How do I fix CVE-2025-9165?
To address CVE-2025-9165, update to the latest version of LibTIFF that resolves the memory leak issue.
What components are affected by CVE-2025-9165?
CVE-2025-9165 specifically affects functions in the LibTIFF component, including _TIFFmallocExt and TIFFHashSetNew.
Is CVE-2025-9165 exploitable remotely?
No, CVE-2025-9165 is restricted to local execution and cannot be exploited remotely.
What impact does CVE-2025-9165 have on applications?
The impact of CVE-2025-9165 includes potential memory leaks which could degrade application performance over time.