CVE-2025-61145 in libtiff
Summary
by MITRE • 02/23/2026
libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/24/2026
The vulnerability identified as CVE-2025-61145 affects the libtiff library version 4.7.1 and earlier, specifically within the tools/tiffcrop.c component. This issue represents a critical double free vulnerability that occurs when the application processes certain malformed TIFF image files during the cropping operation. The flaw manifests when the tiffcrop utility attempts to handle corrupted or maliciously crafted input files, leading to improper memory management that results in the same memory block being freed twice.
This double free condition constitutes a serious memory corruption vulnerability that can be exploited to achieve arbitrary code execution or cause application crashes. The vulnerability arises from insufficient input validation and memory management practices within the tiffcrop utility, which fails to properly handle edge cases during the processing of TIFF image metadata and pixel data structures. The flaw exists in the library's handling of memory allocations and deallocations when processing specific sequences of image operations, particularly when dealing with malformed image headers or corrupted data segments.
From an operational perspective, this vulnerability poses significant risks to systems that rely on libtiff for image processing tasks, including document management systems, digital asset management platforms, and image processing pipelines. Attackers could exploit this vulnerability by crafting malicious TIFF files that, when processed by applications using vulnerable libtiff versions, would trigger the double free condition. The impact extends beyond simple application crashes to potentially enabling remote code execution, making this a critical concern for environments where untrusted image files are processed automatically. This vulnerability aligns with CWE-415, which describes improper handling of memory allocation and deallocation sequences, and represents a classic example of heap-based memory corruption that can be leveraged for privilege escalation or system compromise.
The exploitation of this vulnerability requires an attacker to provide a specially crafted TIFF file that triggers the specific code path within tiffcrop.c where the double free occurs. This typically involves manipulating the image's metadata structure or pixel data in ways that cause the library's internal memory management functions to be called with invalid parameters. The ATT&CK framework categorizes this as a memory corruption vulnerability that could be leveraged through the execution of malicious code in the context of the affected application. Organizations should prioritize updating to libtiff version 4.7.2 or later, which includes patches that address the improper memory management logic. Additional mitigations include implementing strict input validation for TIFF files, running affected applications with reduced privileges, and employing sandboxing techniques to limit the potential impact of successful exploitation attempts. System administrators should also monitor for any suspicious file processing activities that might indicate exploitation attempts and ensure that all image processing workflows are updated to use patched library versions.