Vulnerability record · CVE-2025-8176 · published 26 July 2025

CVE-2025-8176: Libtiff memory buffer overflow vulnerability

Libtiff · Libtiff

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.

1.9 CVSS 4.0 Low EPSS 0.25% · top 85.1% CWE-119 · Memory buffer overflowCWE-416 · Use after free

1.9CVSS 4.0 base score, v2 4.3

0.25%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

7References, 1 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Libtiff Libtiff

References

Link	Tags
http://www.libtiff.org/	Product
https://gitlab.com/libtiff/libtiff/-/commit/fe10872e53efba9cc36c66ac4ab3b41a839d5172	Patch
https://gitlab.com/libtiff/libtiff/-/issues/707	ExploitIssue TrackingVendor Advisory
https://gitlab.com/libtiff/libtiff/-/merge_requests/727	Product
https://vuldb.com/?ctiid.317590	Permissions RequiredVDB Entry
https://vuldb.com/?id.317590	Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.621796	Third Party AdvisoryVDB Entry

Track CVE-2025-8176 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2004-0929Libtiff vulnerabilityHeap-based buffer overflow in the OJPEGVSetField function in tif_ojpeg.c for libtiff 3.6.1 and earlier, when compiled with the OJPEG_SUPPORT (old JPE…EPSS 8.2%27 Jan 2005 10.0CVE-2004-1308Libtiff vulnerabilityInteger overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF fil…EPSS 15%10 Jan 2005 9.8CVE-2016-9540Libtiff memory buffer overflow vulnerabilitytools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103, aka "cpStr…EPSS 3.6%22 Nov 2016 9.8CVE-2016-9539Libtiff memory buffer overflow vulnerabilitytools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer(). Reported as MSVR 35092.EPSS 3.0%22 Nov 2016 9.8CVE-2016-9538Libtiff integer overflow vulnerabilitytools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer in readContigStripsIntoBuffer() because of a uint16 integer overflow. Reported as MSVR 35…EPSS 3.4%22 Nov 2016 9.8CVE-2016-9537Libtiff memory buffer overflow vulnerabilitytools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers. Reported as MSVR 35093, MSVR 35096, and MSVR 35097.EPSS 3.1%22 Nov 2016 9.8CVE-2016-9536Libtiff memory buffer overflow vulnerabilitytools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 350…EPSS 3.1%22 Nov 2016 9.8CVE-2016-9535Libtiff memory buffer overflow vulnerabilitytif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mo…EPSS 4.8%22 Nov 2016

Source: NIST National Vulnerability Database (record CVE-2025-8176), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.