libtiff dereferences a null pointer while opening a file
libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.
- Advisory
- CVE-2025-61143
- Library
- libtiff, tiff on Debian
- Published
- Severity
- 5.5 out of 10, as published
- Affected
- libtiff up to 4.7.1
- Fixed in
- see the upstream record
- Reaches you
- by opening a file
What triggers it
Opening a crafted TIFF that reaches a null pointer in tif_open.c.
What sillybos does
Needs decoding to detect
The flaw is in the pixel data or the compressed stream, which only a decoder can see. Nothing before the decoder can refuse it; updating the decoder is the fix.
In TIFFOpen's own setup, before any tag that a header check could judge; the upstream record names no field. Out of a pre-decode check's reach, and a crash on open costs one file in a boxed process.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
How to protect yourself
In general. Upgrade libtiff to a version that has the fix; the upstream record names it.
Specifically. Decode in a boxed process (see Decoding in a box).
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/DEBIAN-CVE-2025-61143
- The record entry, triaged 2026-11-03, last checked 2026-11-03