CVE-2025-61145: Libtiff Use-After-Free Vulnerability

CVE-2025-61145 Overview

A double free vulnerability has been discovered in libtiff versions up to v4.7.1. The vulnerability exists within the tools/tiffcrop.c component, which is used for cropping and manipulating TIFF image files. A double free condition occurs when memory is freed more than once, leading to memory corruption and potential denial of service conditions.

Critical Impact
Exploitation of this double free vulnerability can result in application crashes and denial of service when processing maliciously crafted TIFF image files.

Affected Products

libtiff versions up to and including v4.7.1
Applications and systems utilizing the libtiff library for TIFF image processing
Systems using the tiffcrop utility

Discovery Timeline

2026-02-23 - CVE-2025-61145 published to NVD
2026-02-25 - Last updated in NVD database

Technical Details for CVE-2025-61145

Vulnerability Analysis

This vulnerability is classified as CWE-415 (Double Free), a memory corruption flaw that occurs when the same memory location is freed multiple times. In the context of libtiff, the vulnerability manifests in the tiffcrop.c component, which handles TIFF image cropping operations.

Double free vulnerabilities can corrupt memory allocation structures, potentially leading to arbitrary write conditions or application crashes. While this particular vulnerability requires local access and user interaction to exploit, it presents a significant denial of service risk for systems processing untrusted TIFF images.

The attack requires local access with low privileges and user interaction, such as opening a maliciously crafted TIFF file with the tiffcrop utility. Successful exploitation leads to high availability impact through application crashes or system instability.

Root Cause

The root cause of this vulnerability lies in improper memory management within the tiffcrop.c component. The code path fails to properly track memory allocation state, resulting in a scenario where the same memory buffer is passed to the free() function multiple times. This typically occurs due to missing or incorrect pointer nullification after the initial free operation, combined with error handling paths that attempt to clean up already-freed memory.

Attack Vector

Exploitation of this vulnerability requires local access to the target system. An attacker would need to craft a malicious TIFF image file that triggers the vulnerable code path when processed by the tiffcrop utility. The attack scenario involves:

Crafting a specially malformed TIFF image file designed to trigger the double free condition
Convincing a user to process the malicious file using tiffcrop or an application that utilizes the vulnerable libtiff functionality
Upon processing, the double free condition corrupts memory structures, causing the application to crash

For detailed technical analysis and proof-of-concept information, refer to the GitLab Issue #736 Discussion and the GitHub Gist Code Snippet which contain additional vulnerability details.

Detection Methods for CVE-2025-61145

Indicators of Compromise

Unexpected crashes or segmentation faults in applications using libtiff when processing TIFF files
Core dumps containing references to tiffcrop.c or libtiff memory management functions
Unusual TIFF files with malformed headers or corrupted metadata structures

Detection Strategies

Monitor for application crashes in processes that utilize the libtiff library, particularly the tiffcrop utility
Implement file integrity monitoring for TIFF processing workflows to detect potentially malicious input files
Deploy memory sanitizers (ASan, MSan) in development and testing environments to catch double free conditions early

Monitoring Recommendations

Enable crash reporting and logging for all applications that process TIFF images
Configure system monitoring to alert on repeated segmentation faults from libtiff-dependent processes
Implement file upload validation that inspects TIFF files for known malicious patterns before processing

How to Mitigate CVE-2025-61145

Immediate Actions Required

Upgrade libtiff to a patched version when available from the vendor
Restrict access to the tiffcrop utility and limit its use to trusted TIFF files only
Implement input validation for all TIFF files before processing, especially from untrusted sources
Consider using containerization or sandboxing for TIFF processing workflows to limit impact of potential crashes

Patch Information

A patch addressing this vulnerability is available via GitLab Merge Request #753. Organizations should review the merge request and apply the patch or upgrade to a fixed version of libtiff when officially released. Monitor the libtiff project for official release announcements containing this security fix.

Workarounds

Avoid processing TIFF files from untrusted or unknown sources until the patch is applied
Use alternative TIFF processing tools that are not affected by this vulnerability where possible
Implement strict file type validation and content inspection before passing files to tiffcrop
Run tiffcrop and related utilities in isolated environments with limited system access

bash

# Configuration example - Run tiffcrop in isolated environment
# Create restricted directory for TIFF processing
mkdir -p /opt/tiff_sandbox
chown root:tiffprocessors /opt/tiff_sandbox
chmod 750 /opt/tiff_sandbox

# Run tiffcrop with resource limits (Linux)
ulimit -v 524288  # Limit virtual memory to 512MB
ulimit -c 0       # Disable core dumps
timeout 30 tiffcrop input.tif output.tif