How severe is CVE-2025-9165?

CVE-2025-9165 has a CVSS 3.x base score of 2.5, rated low severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2025-9165 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-9165?

CVE-2025-9165 affects Libtiff. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-9165?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-9165 have an EU (EUVD) identifier?

Yes. CVE-2025-9165 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-25249.

When was CVE-2025-9165 published?

CVE-2025-9165 was published on 2025-08-19 and last updated on 2026-06-17.

CVE-2025-9165

CVE-2025-9165 is a low-severity vulnerability in Libtiff with a CVSS 3.x base score of 2.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-401.

Key facts

Severity: Low (CVSS 3.x base score 2.5)
CVSS v2: 1.0
CVSS v4: 1.1
EPSS exploit prediction: 0% (9th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-25249
Weakness: CWE-401
Affected product: Libtiff
Published: 2025-08-19
Last modified: 2026-06-17

Description

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".

Frequently asked questions

What is CVE-2025-9165?: A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".
How severe is CVE-2025-9165?: CVE-2025-9165 has a CVSS 3.x base score of 2.5, rated low severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2025-9165 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-9165?: CVE-2025-9165 affects Libtiff. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-9165?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-9165 have an EU (EUVD) identifier?: Yes. CVE-2025-9165 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-25249.
When was CVE-2025-9165 published?: CVE-2025-9165 was published on 2025-08-19 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:libtiff:libtiff:4.7.0:*:*:*:*:*:*:*

More vulnerabilities in Libtiff

CVE-2004-0929 — Critical (CVSS 10.0): Heap-based buffer overflow in the OJPEGVSetField function in tif_ojpeg.c for libtiff 3.6.1 and earlier, when compiled…
CVE-2004-1308 — Critical (CVSS 10.0): Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute…
CVE-2016-9540 — Critical (CVSS 9.8): tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width.…
CVE-2016-9539 — Critical (CVSS 9.8): tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer(). Reported as MSVR 35092.
CVE-2016-9538 — Critical (CVSS 9.8): tools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer in readContigStripsIntoBuffer() because of a uint16 integer…
CVE-2016-9537 — Critical (CVSS 9.8): tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers. Reported as MSVR 35093, MSVR…

All CVEs affecting Libtiff →

Other CWE-401 (Missing Release of Memory after Effective Lifetime) vulnerabilities

CVE-2026-46289 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length calculations in…
CVE-2022-0742 — Critical (CVSS 9.1): Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go…
CVE-2024-25450 — High (CVSS 8.8): imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts().
CVE-2023-33718 — High (CVSS 8.8): mp4v2 v2.1.3 was discovered to contain a memory leak via MP4File::ReadString() at mp4file_io.cpp
CVE-2021-40633 — High (CVSS 8.8): A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of…
CVE-2021-3492 — High (CVSS 8.8): Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring…

Browse all CWE-401 (Missing Release of Memory after Effective Lifetime) vulnerabilities →