libtiff

Tools for Converting from and to the Tagged Image File Format

Current: 4.7.0
Candidate: 4.7.2Stale

License: HPND

Build

Target	Result	Last successful version	Succeeded at
rva23	Succeeded	4.7.0	2026-09-24 10:58:41 UTC
rva20	Succeeded	4.7.0	2026-09-24 16:40:31 UTC
x86_64	Succeeded	4.7.0	2026-09-22 00:16:58 UTC

Advisory · 9

Query product: libtiffNVD
Query vendor: libtiffNVD
Query version: 4.7.0NVD

Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.

CVE-2024-13978
NVD
Summary
A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.228%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*; <= 4.7.0NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:L/AC:H/Au:S/C:N/I:N/A:PNVD
CVSS_V3
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:LNVD
CVSS_V4
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
References
Advisory · gitlab.com Fix · 2ebfffb0e883 Web · gitlab.com Web · lists.debian.org Web · vuldb.com Web · vuldb.com Web · vuldb.com
CVE-2025-61143
NVD
Summary
libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.136%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*; < 4.7.1NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HNVD
References
Web · gist.github.com Web · gitlab.com Web · gitlab.com
CVE-2025-61144
NVD
Summary
libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.303%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*; < 4.7.1NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
References
Fix · 09f53a86cf26 Fix · 88cf9dbb48f6 Web · gist.github.com Web · gitlab.com Web · gitlab.com
CVE-2025-61145
NVD
Summary
libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.157%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*; < 4.7.1NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:HNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HNVD
References
Web · gist.github.com Web · gitlab.com Web · gitlab.com
CVE-2025-8176
NVD
Summary
A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.287%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*; <= 4.7.0NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:L/AC:L/Au:S/C:P/I:P/A:PNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LNVD
CVSS_V4
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
References
Advisory · gitlab.com Fix · fe10872e53ef Web · gitlab.com Web · vuldb.com Web · vuldb.com Web · vuldb.com
CVE-2025-8177
NVD
Summary
A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.327%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*; <= 4.7.0NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:L/AC:L/Au:S/C:P/I:P/A:PNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LNVD
CVSS_V4
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
References
Advisory · gitlab.com Fix · e8c9d6c616b1 Web · gitlab.com Web · vuldb.com Web · vuldb.com Web · vuldb.com
CVE-2025-8961
NVD
Summary
A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.229%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libtiff:libtiff:4.7.0:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:L/AC:L/Au:S/C:N/I:N/A:PNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LNVD
CVSS_V4
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
References
Advisory · gitlab.com Advisory · gitlab.com Web · drive.google.com Web · vuldb.com Web · vuldb.com Web · vuldb.com
CVE-2025-9165
NVD
Summary
A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch…NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.248%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libtiff:libtiff:4.7.0:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:L/AC:H/Au:S/C:N/I:N/A:PNVD
CVSS_V3
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:LNVD
CVSS_V4
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
Summary characters omitted
315NVD
References
Advisory · gitlab.com Advisory · gitlab.com Fix · ed141286a37f Fix · gitlab.com Web · drive.google.com Web · vuldb.com Web · vuldb.com Web · vuldb.com Web · vuldb.com
CVE-2026-4775
NVD
Summary
A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.583%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*; < 4.7.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HNVD
Additional references
20NVD
References
Advisory · access.redhat.com Advisory · access.redhat.com Advisory · access.redhat.com Advisory · access.redhat.com Advisory · access.redhat.com Advisory · access.redhat.com Advisory · access.redhat.com Advisory · access.redhat.com Advisory · access.redhat.com Advisory · access.redhat.com Advisory · access.redhat.com Advisory · access.redhat.com

Description

This package contains the library and support programs for the TIFF image format. To link a program with libtiff, you will have to add -ljpeg and -lz to include the necessary libjpeg and libz in the linking process.

Changelog

SPECS: libtiff: Format pc file.
yyjeqhc86c2e20d8af72026-03-31 10:29:50 UTC
SPECS: libtiff: Fix spec file formatting.
misaka00251876e7dd472842026-01-26 14:54:58 UTC
SPECS: glibc: Auto call ldconfig.
Zheng Junjie24d6ed4da5ec2025-12-01 14:10:56 UTC
Initial commit
Z572bc722d18574a2025-08-05 09:00:05 UTC

PR · 3

#1499 SPECS: python-pillow: Update to 13.0.0. [security-fixes]
misaka002512026-10-28 12:57:32 UTC
#122 SPECS: format pc files.
yyjeqhc2026-04-14 08:34:55 UTC
#104 SPECS: *: Fix style %{?autochangelog} -> %autochangelog (automated)
dramforever2026-04-09 06:15:39 UTC

Checks

Monitor	Observation	Last checked
Source	Stale Repository refresh: git fetch exited 128 (authentication)	2026-11-10 17:23:44 UTC
Version	Stale Source last confirmed at 2026-11-10T17:23:44+00:00; repository refresh overdue.	2026-11-10 17:37:16 UTC
Build	Checked	2026-11-10 19:24:15 UTC
GitHub	Checked	2026-11-10 19:16:46 UTC
EOL	Not configured No reliable monitor identity/configuration.	—
LicenseDiff	Not configured No reliable monitor identity/configuration.	—
Dependencies	Not configured No reliable monitor identity/configuration.	—
Advisory	Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated.	2026-11-10 18:53:26 UTC Last attempted2026-11-10 18:55:19 UTC
Yanked	Not configured No reliable monitor identity/configuration.	—

Monitor	Checks
Source	6367 Stale 17 CheckFailed
Version	5459 Stale 210 CheckFailed 707 Not configured 8 Input unavailable
Build	6382 Checked 2 Not yet checked
GitHub	6384 Checked
EOL	6260 Not configured 118 Checked 3 Metadata unavailable 3 Input unavailable
LicenseDiff	1665 Not configured 187 Input changed 3168 Not applicable 12 Input unavailable 1139 Checked 209 Metadata unavailable 4 CheckFailed
Dependencies	1852 Not configured 3214 Checked 1248 Metadata unavailable 7 Input unavailable 58 Partial evidence 5 CheckFailed
Advisory	4996 Checked 1375 Not configured 7 Input unavailable 6 Metadata unavailable
Yanked	2248 Not configured 4116 Checked 5 CheckFailed 7 Input unavailable 8 Metadata unavailable