DEBIAN-CVE-2025-9165
Record from OSV · Published August 19, 2025
A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| tiff | Debian:14 | 4.7.0-4 |
| tiff | Debian:13 | 4.7.0-3+deb13u1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | tiff | 0, 4.7.0-3 |
| Debian:12 | tiff | 4.5.0-6+deb12u1, 4.5.0-6+deb12u2, 4.5.0-6+deb12u3 |
| Debian:13 | tiff | 0, 4.7.0-3 |
Timeline
- Aug 19, 2025 CVE Published
- Sep 1, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2025-9165
vulnetix vdb fixes DEBIAN-CVE-2025-9165Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2025-9165/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart