CVE-2025-61144: Libtiff Buffer Overflow Vulnerability

CVE-2025-61144 Overview

A stack overflow vulnerability was discovered in libtiff versions up to v4.7.1. The flaw exists within the readSeparateStripsIntoBuffer function, which can be exploited by an attacker to cause memory corruption. This vulnerability falls under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating that the application fails to properly validate memory operations, potentially leading to code execution or denial of service conditions.

Critical Impact

Local attackers with limited privileges can exploit this stack overflow vulnerability to potentially achieve high impact on confidentiality, integrity, and availability of affected systems through crafted TIFF image files.

Affected Products

• libtiff versions up to and including v4.7.1
• Applications and libraries that depend on libtiff for TIFF image processing
• Systems processing untrusted TIFF files using vulnerable libtiff versions

Discovery Timeline

• 2026-02-23 - CVE-2025-61144 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2025-61144

Vulnerability Analysis

This vulnerability is a stack overflow in the readSeparateStripsIntoBuffer function within libtiff. The function is responsible for reading TIFF image data organized in separate strips (planar configuration) into a buffer. When processing specially crafted TIFF files, the function fails to properly validate buffer boundaries, resulting in a stack-based buffer overflow condition.

The attack requires local access to the system and user interaction (such as opening a malicious TIFF file). Upon successful exploitation, an attacker could potentially achieve arbitrary code execution with the privileges of the user running the vulnerable application, or cause the application to crash, resulting in denial of service.

Root Cause

The root cause of this vulnerability is improper bounds checking within the readSeparateStripsIntoBuffer function. When handling TIFF images with separate strip configurations, the function allocates stack-based buffers without adequately validating that the data being read will fit within the allocated space. Maliciously crafted TIFF files can specify strip parameters that cause the function to write beyond the stack buffer boundaries, corrupting the stack and potentially allowing control flow hijacking.

Attack Vector

The attack vector is local, requiring the attacker to either have direct access to the system or to trick a user into opening a malicious TIFF file. The exploitation scenario typically involves:

1. An attacker crafts a malicious TIFF file with specially constructed strip metadata
2. The victim opens the file using an application that relies on libtiff for image processing
3. The readSeparateStripsIntoBuffer function processes the malformed strip data
4. Stack memory is overwritten due to insufficient bounds checking
5. The attacker potentially gains code execution or causes application crash

The vulnerability has been documented with a proof-of-concept available through the GitHub Gist PoC. Additional technical details can be found in LibTIFF Issue #740.

Detection Methods for CVE-2025-61144

Indicators of Compromise

• Unexpected crashes in applications processing TIFF files, particularly those using planar/separate strip configurations
• Abnormal memory access patterns or segmentation faults in libtiff-dependent applications
• Stack corruption warnings or core dumps from applications utilizing the readSeparateStripsIntoBuffer function

Detection Strategies

• Monitor application logs for crashes related to TIFF file processing, especially those mentioning readSeparateStripsIntoBuffer or related functions
• Implement file integrity monitoring to detect suspicious TIFF files with unusual strip metadata
• Deploy endpoint detection solutions capable of identifying stack buffer overflow exploitation attempts

Monitoring Recommendations

• Enable crash dump collection for applications that process TIFF images to capture exploitation attempts
• Monitor for repeated application restarts or crashes when processing image files from untrusted sources
• Implement network monitoring to detect potential exfiltration following successful exploitation

How to Mitigate CVE-2025-61144

Immediate Actions Required

• Update libtiff to a patched version that addresses this vulnerability
• Review and audit applications that depend on libtiff for TIFF image processing
• Restrict processing of TIFF files from untrusted sources until patches can be applied
• Consider implementing application sandboxing for programs that handle untrusted image files

Patch Information

The libtiff maintainers have released patches to address this vulnerability. Two commits have been made available:

• LibTIFF Commit 09f53a86 - Primary security fix
• LibTIFF Commit 88cf9dbb - Additional hardening

The fix involves proper bounds validation in the readSeparateStripsIntoBuffer function to ensure that strip data cannot overflow stack buffers. Organizations should apply these patches or upgrade to a libtiff version that includes them. Additional details about the fix can be found in LibTIFF Merge Request #757.

Workarounds

• Disable or restrict processing of TIFF images with separate/planar strip configurations until patches are applied
• Implement strict input validation for TIFF files before processing, rejecting files with suspicious or malformed strip metadata
• Run applications that process untrusted TIFF files in sandboxed environments with restricted privileges
• Deploy host-based intrusion prevention systems (HIPS) with stack protection capabilities

# Configuration example - Verify installed libtiff version and check for vulnerable installations
# Check current libtiff version
pkg-config --modversion libtiff

# Find applications linked against libtiff
ldd /usr/bin/your_app | grep libtiff

# Update libtiff on Debian/Ubuntu systems
sudo apt update && sudo apt upgrade libtiff-dev libtiff-tools

# Update libtiff on RHEL/CentOS systems  
sudo yum update libtiff libtiff-devel