CVE-2025-8534

low-risk
Published 2025-08-05

A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used."

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.5/10 Low
LOCAL / HIGH complexity

Affected Products (1)

Affected Vendors

Libtiff

References (10)

Product http://www.libtiff.org/
Exploit https://drive.google.com/file/d/15JPA3kLYiYD-nRNJ8y8HmnYjhv9NE7k6/view?usp=drive...
Patch https://gitlab.com/libtiff/libtiff/-/commit/6ba36f159fd396ad11bf6b7874554197736e...
Exploit https://gitlab.com/libtiff/libtiff/-/issues/718
Product https://gitlab.com/libtiff/libtiff/-/merge_requests/746
Permissions Required https://vuldb.com/?ctiid.318664
Third Party Advisory https://vuldb.com/?id.318664
Third Party Advisory https://vuldb.com/?submit.617831
Exploit https://gitlab.com/libtiff/libtiff/-/issues/718
Third Party Advisory https://vuldb.com/?submit.617831
11
/ 100
low-risk
Severity 6/34 · Minimal
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal