CVE-2025-61143: Libtiff NULL Pointer Dereference Flaw

CVE-2025-61143 Overview

A NULL pointer dereference vulnerability has been discovered in libtiff up to version 4.7.1. The vulnerability exists within the libtiff/tif_open.c component, where improper handling of pointer operations can lead to application crashes. This memory corruption issue allows an attacker to cause a denial of service condition by providing specially crafted TIFF image files that trigger the NULL pointer dereference during file processing operations.

Critical Impact

Successful exploitation of this vulnerability can result in denial of service through application crashes when processing maliciously crafted TIFF files.

Affected Products

• libtiff versions up to and including 4.7.1
• Applications and libraries that depend on libtiff for TIFF image processing
• Operating systems and distributions shipping vulnerable libtiff versions

Discovery Timeline

• 2026-02-23 - CVE-2025-61143 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2025-61143

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference), a memory corruption vulnerability that occurs when an application attempts to dereference a pointer that has a NULL value. In the context of libtiff, this flaw resides in the tif_open.c file, which handles TIFF file opening operations.

When libtiff processes a TIFF file, the affected code path fails to properly validate pointer values before dereferencing them. This allows an attacker to craft a malicious TIFF file that, when processed by an application using the vulnerable libtiff library, triggers the NULL pointer dereference condition. The result is an immediate application crash, causing denial of service.

The vulnerability requires local access and user interaction, meaning an attacker must convince a victim to open a malicious TIFF file using an application that relies on libtiff for image processing.

Root Cause

The root cause of this vulnerability lies in insufficient pointer validation within the tif_open.c component. The code fails to verify that pointer values are non-NULL before attempting to access the memory locations they reference. This oversight allows specially crafted input to manipulate the execution flow into a state where a NULL pointer is dereferenced, causing the application to crash.

Attack Vector

The attack vector is local and requires user interaction. An attacker would need to:

1. Craft a malicious TIFF image file designed to trigger the NULL pointer dereference
2. Deliver this file to the victim through social engineering, email attachments, or web downloads
3. Convince the victim to open the file using an application that processes TIFF images via libtiff

When the victim opens the malicious file, the vulnerable libtiff library processes it, encounters the NULL pointer condition, and crashes the application. This constitutes a denial of service attack. Technical details and proof-of-concept information are available in the GitLab Issue #737 Discussion and GitHub Gist PoC Code.

Detection Methods for CVE-2025-61143

Indicators of Compromise

• Unexpected application crashes when opening or processing TIFF image files
• Core dumps or crash reports showing NULL pointer dereference in libtiff components
• System logs indicating segmentation faults originating from libtiff library calls
• Unusual TIFF files with malformed headers or structures in user directories

Detection Strategies

• Monitor application crash logs for crashes involving libtiff or TIFF processing functions
• Implement file integrity monitoring to detect unusual TIFF files being introduced to systems
• Use SentinelOne's behavioral AI to detect anomalous application crashes following file operations
• Deploy endpoint detection rules that correlate TIFF file access with immediate process termination

Monitoring Recommendations

• Enable crash reporting and monitoring for applications that process image files
• Configure SentinelOne agents to alert on repeated application crashes that may indicate exploitation attempts
• Monitor network traffic for delivery of potentially malicious TIFF files via email or web downloads
• Review system logs for patterns of crashes affecting image processing applications

How to Mitigate CVE-2025-61143

Immediate Actions Required

• Update libtiff to the latest patched version that addresses this vulnerability
• Review and audit applications in your environment that depend on libtiff for image processing
• Implement file type restrictions to limit exposure to untrusted TIFF files
• Consider temporarily disabling TIFF processing in critical applications until patches are applied

Patch Information

The libtiff development team has addressed this vulnerability through GitLab Merge Request #755. Organizations should update to the patched version of libtiff as soon as it becomes available through their package management systems or by building from source. For detailed technical discussion of the fix, refer to GitLab Issue #737 Discussion.

Workarounds

• Restrict TIFF file processing to trusted sources only until patches can be applied
• Implement input validation and sandboxing for applications that process untrusted TIFF files
• Use SentinelOne's application control features to restrict which applications can process TIFF files
• Consider using alternative image processing libraries for critical applications until libtiff is patched
• Educate users about the risks of opening TIFF files from untrusted sources