CVE-2025-61145

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

5.0 MediumFix available

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.16%Up 0.1 points since Feb 24, 2026

What each source reports

NVD Score used 5.0

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Record: CVE-2025-61145
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-415
Updated: 2026-11-02

CVE List 5.5

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Record: CVE-2025-61145
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-415
Updated: 2026-11-02

EUVDEUVD-2025-207644 5.5

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Record: EUVD-2025-207644
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5jj2-qhxw-rpq6 5.0

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Record: GHSA-5jj2-qhxw-rpq6
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-415
Updated: 2026-11-02

OSVBELL-CVE-2025-61145 5.0

Record: BELL-CVE-2025-61145
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 5.5

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Record: CVE-2025-61145
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 11 moreShow less

OSVDEBIAN-CVE-2025-61145 5.0

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Record: DEBIAN-CVE-2025-61145
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVJLSEC-2026-486 5.0

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Record: JLSEC-2026-486
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:7504 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:7504
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-61145 5.0

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Record: UBUNTU-CVE-2025-61145
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-78314 No score

CVE-2025-61145 affecting package libtiff for versions less than 4.6.0-11

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Record: AZL-78314
Updated: 2026-11-05

OSVAZL-78333 No score

CVE-2025-61145 affecting package libtiff for versions less than 4.6.0-11

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Record: AZL-78333
Updated: 2026-11-02

OSVCLSA-2026-1772642268 No score

libtiff: Fix of 3 CVEs

CVE-2025-61145: fix double free in tiffcrop; add pointer validation and guard against second free.

Record: CLSA-2026-1772642268
Updated: 2026-11-02

OSVCLSA-2026-1773829377 No score

libtiff: Fix of CVE-2025-61145

CVE-2025-61145: fix double-free and memory leak in tiffcrop, avoid dangling pointer in loadImage by clearing *read_ptr after free

Record: CLSA-2026-1773829377
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2025-61145 No score

CVE-2025-61145 in tiff - Patched by Root

Root has patched CVE-2025-61145 in the tiff package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2025-61145
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2025-61145 No score

CVE-2025-61145 in tiff - Patched by Root

Root has patched CVE-2025-61145 in the tiff package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2025-61145
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-13-CVE-2025-61145 No score

CVE-2025-61145 in tiff - Patched by Root

Root has patched CVE-2025-61145 in the tiff package for Root:Debian:13. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-13-CVE-2025-61145
Updated: 2026-11-02

Affected products

libtiff

Affected packages

Affected packages
Package	Affected	Fixed
`libtiff` Azure Linux:3	before 4.6.0-11	4.6.0-11
`libtiff` Azure Linux:2	before 4.6.0-11	4.6.0-11
`tiff` Alpaquita:23	4.4.0-r1 up to 4.4.0-r5	4.4.0-r5
`tiff` Alpaquita:25	4.7.0-r0 up to 4.7.1-r0	4.7.1-r0
`tiff` Alpaquita:stream	4.4.0-r1 up to 4.7.1-r0	4.7.1-r0
`tiff` BellSoft Hardened Containers:23	4.4.0-r1 up to 4.4.0-r5	4.4.0-r5
`tiff` BellSoft Hardened Containers:25	4.7.0-r0 up to 4.7.1-r0	4.7.1-r0
`tiff` BellSoft Hardened Containers:stream	4.4.0-r1 up to 4.7.1-r0	4.7.1-r0
`libtiff` TuxCare:AlmaLinux:9.6	before 4.4.0-13.el9_6.2.tuxcare.els4	4.4.0-13.el9_6.2.tuxcare.els4
`libtiff-devel` TuxCare:AlmaLinux:9.6	before 4.4.0-13.el9_6.2.tuxcare.els4	4.4.0-13.el9_6.2.tuxcare.els4

Show 45 moreShow less

Affected packages
Package	Affected	Fixed
`libtiff-static` TuxCare:AlmaLinux:9.6	before 4.4.0-13.el9_6.2.tuxcare.els4	4.4.0-13.el9_6.2.tuxcare.els4
`libtiff-tools` TuxCare:AlmaLinux:9.6	before 4.4.0-13.el9_6.2.tuxcare.els4	4.4.0-13.el9_6.2.tuxcare.els4
`libtiff` TuxCare:AlmaLinux:9.2	before 4.4.0-8.el9_2.tuxcare.els8	4.4.0-8.el9_2.tuxcare.els8
`libtiff-devel` TuxCare:AlmaLinux:9.2	before 4.4.0-8.el9_2.tuxcare.els8	4.4.0-8.el9_2.tuxcare.els8
`libtiff-static` TuxCare:AlmaLinux:9.2	before 4.4.0-8.el9_2.tuxcare.els8	4.4.0-8.el9_2.tuxcare.els8
`libtiff-tools` TuxCare:AlmaLinux:9.2	before 4.4.0-8.el9_2.tuxcare.els8	4.4.0-8.el9_2.tuxcare.els8
`tiff` Debian:12	All versions, plus listed versions 4.5.0-64.5.0-6+deb12u14.5.0-6+deb12u24.5.0-6+deb12u34.5.0-6+deb12u4 Show 18 moreShow less 4.5.1+git230720-14.5.1+git230720-24.5.1+git230720-34.5.1+git230720-44.5.1+git230720-54.5.1-14.5.1~rc3-14.6.0-14.6.0-24.7.0-14.7.0-24.7.0-34.7.0-44.7.0-54.7.1-14.7.1-24.7.1-34.7.2-1	None known
`tiff` Debian:13	All versions, plus listed versions 4.7.0-34.7.0-3+deb13u14.7.0-3+deb13u24.7.0-3+deb13u34.7.0-4 Show 5 moreShow less 4.7.0-54.7.1-14.7.1-24.7.1-34.7.2-1	None known
`tiff` Debian:14	before 4.7.1-1, plus listed versions 4.7.0-34.7.0-44.7.0-5	4.7.1-1
`Libtiff_jll` Julia	before 4.7.2+0	4.7.2+0
`libtiff` Red Hat:hummingbird:1 From an advisory covering 4 CVEs	before 0:4.7.1-2.1.hum1	0:4.7.1-2.1.hum1
`libtiff-devel` Red Hat:hummingbird:1 From an advisory covering 4 CVEs	before 0:4.7.1-2.1.hum1	0:4.7.1-2.1.hum1
`libtiff-static` Red Hat:hummingbird:1 From an advisory covering 4 CVEs	before 0:4.7.1-2.1.hum1	0:4.7.1-2.1.hum1
`libtiff-tools` Red Hat:hummingbird:1 From an advisory covering 4 CVEs	before 0:4.7.1-2.1.hum1	0:4.7.1-2.1.hum1
`tiff` Root:Debian:11	before 4.2.0-1+deb11u8.aikido.17	4.2.0-1+deb11u8.aikido.174.2.0-1+deb11u8.aikido.194.2.0-1+deb11u8.aikido.184.2.0-1+deb11u8.root.io.164.2.0-1+deb11u8.aikido.20
`rootio-tiff` Root:Debian:11	before 4.2.0-1+deb11u8.aikido.17	4.2.0-1+deb11u8.aikido.174.2.0-1+deb11u8.aikido.194.2.0-1+deb11u8.aikido.184.2.0-1+deb11u8.root.io.164.2.0-1+deb11u8.aikido.20
`tiff` Root:Debian:12	before 4.5.0-6+deb12u4.aikido.20	4.5.0-6+deb12u4.aikido.204.5.0-6+deb12u4.root.io.194.5.0-6+deb12u4.aikido.214.5.0-6+deb12u4.aikido.22
`rootio-tiff` Root:Debian:12	before 4.5.0-6+deb12u4.aikido.20	4.5.0-6+deb12u4.aikido.204.5.0-6+deb12u4.root.io.194.5.0-6+deb12u4.aikido.214.5.0-6+deb12u4.aikido.22
`tiff` Root:Debian:13	before 4.7.0-3+deb13u3.aikido.8	4.7.0-3+deb13u3.aikido.84.7.0-3+deb13u3.aikido.94.7.0-3+deb13u3.aikido.74.7.0-3+deb13u3.aikido.10
`rootio-tiff` Root:Debian:13	before 4.7.0-3+deb13u3.aikido.8	4.7.0-3+deb13u3.aikido.84.7.0-3+deb13u3.aikido.94.7.0-3+deb13u3.aikido.74.7.0-3+deb13u3.aikido.10
`gdal` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1.9.0-3.1ubuntu41.9.0-3.1ubuntu61.10.1+dfsg-21.10.1+dfsg-2build11.10.1+dfsg-3 Show 8 moreShow less 1.10.1+dfsg-3build11.10.1+dfsg-3build21.10.1+dfsg-3ubuntu11.10.1+dfsg-3ubuntu21.10.1+dfsg-5ubuntu11.10.1+dfsg-5ubuntu1+esm11.10.1+dfsg-5ubuntu1+esm21.10.1+dfsg-5ubuntu1+esm3	None known
`tiff` Ubuntu:Pro:14.04:LTS	before 4.0.3-7ubuntu0.11+esm16, plus listed versions 4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-7 Show 25 moreShow less 4.0.3-7ubuntu0.14.0.3-7ubuntu0.24.0.3-7ubuntu0.34.0.3-7ubuntu0.44.0.3-7ubuntu0.64.0.3-7ubuntu0.74.0.3-7ubuntu0.84.0.3-7ubuntu0.94.0.3-7ubuntu0.104.0.3-7ubuntu0.114.0.3-7ubuntu0.11+esm14.0.3-7ubuntu0.11+esm24.0.3-7ubuntu0.11+esm34.0.3-7ubuntu0.11+esm44.0.3-7ubuntu0.11+esm54.0.3-7ubuntu0.11+esm64.0.3-7ubuntu0.11+esm74.0.3-7ubuntu0.11+esm84.0.3-7ubuntu0.11+esm94.0.3-7ubuntu0.11+esm104.0.3-7ubuntu0.11+esm114.0.3-7ubuntu0.11+esm124.0.3-7ubuntu0.11+esm134.0.3-7ubuntu0.11+esm144.0.3-7ubuntu0.11+esm15	4.0.3-7ubuntu0.11+esm16
`tiff` Ubuntu:Pro:16.04:LTS	before 4.0.6-1ubuntu0.8+esm19, plus listed versions 4.0.3-12.3ubuntu24.0.5-14.0.6-14.0.6-1ubuntu0.14.0.6-1ubuntu0.2 Show 23 moreShow less 4.0.6-1ubuntu0.34.0.6-1ubuntu0.44.0.6-1ubuntu0.54.0.6-1ubuntu0.64.0.6-1ubuntu0.74.0.6-1ubuntu0.84.0.6-1ubuntu0.8+esm14.0.6-1ubuntu0.8+esm24.0.6-1ubuntu0.8+esm34.0.6-1ubuntu0.8+esm44.0.6-1ubuntu0.8+esm64.0.6-1ubuntu0.8+esm74.0.6-1ubuntu0.8+esm84.0.6-1ubuntu0.8+esm94.0.6-1ubuntu0.8+esm104.0.6-1ubuntu0.8+esm114.0.6-1ubuntu0.8+esm124.0.6-1ubuntu0.8+esm134.0.6-1ubuntu0.8+esm144.0.6-1ubuntu0.8+esm154.0.6-1ubuntu0.8+esm164.0.6-1ubuntu0.8+esm174.0.6-1ubuntu0.8+esm18	4.0.6-1ubuntu0.8+esm19
`gdal` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.11.2+dfsg-3ubuntu31.11.2+dfsg-3ubuntu41.11.3+dfsg-2build11.11.3+dfsg-2build21.11.3+dfsg-2build3 Show 5 moreShow less 1.11.3+dfsg-31.11.3+dfsg-3build11.11.3+dfsg-3build21.11.3+dfsg-3ubuntu0.1~esm11.11.3+dfsg-3ubuntu0.1~esm2	None known
`tiff` Ubuntu:Pro:18.04:LTS	before 4.0.9-5ubuntu0.10+esm9, plus listed versions 4.0.8-54.0.8-64.0.9-14.0.9-24.0.9-3 Show 21 moreShow less 4.0.9-44.0.9-4ubuntu14.0.9-54.0.9-5ubuntu0.14.0.9-5ubuntu0.24.0.9-5ubuntu0.34.0.9-5ubuntu0.44.0.9-5ubuntu0.54.0.9-5ubuntu0.64.0.9-5ubuntu0.74.0.9-5ubuntu0.84.0.9-5ubuntu0.94.0.9-5ubuntu0.104.0.9-5ubuntu0.10+esm14.0.9-5ubuntu0.10+esm24.0.9-5ubuntu0.10+esm34.0.9-5ubuntu0.10+esm44.0.9-5ubuntu0.10+esm54.0.9-5ubuntu0.10+esm64.0.9-5ubuntu0.10+esm74.0.9-5ubuntu0.10+esm8	4.0.9-5ubuntu0.10+esm9
`neuron` Ubuntu:18.04:LTS	All versions, plus listed versions 7.5-1	None known
`qtwebengine-opensource-src` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 5.9.1+dfsg-45.9.1+dfsg-4ubuntu15.9.2+dfsg-2ubuntu15.9.3+dfsg-0ubuntu15.9.4+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2+esm1	None known
`texmaker` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 4.5-15.0.2-15.0.2-1build15.0.2-1build25.0.2-1ubuntu0.1~esm1	None known
`tiff` Ubuntu:Pro:20.04:LTS	before 4.1.0+git191117-2ubuntu0.20.04.14+esm2, plus listed versions 4.0.10+git191003-14.1.0+git191117-14.1.0+git191117-24.1.0+git191117-2build14.1.0+git191117-2ubuntu0.20.04.1 Show 14 moreShow less 4.1.0+git191117-2ubuntu0.20.04.24.1.0+git191117-2ubuntu0.20.04.34.1.0+git191117-2ubuntu0.20.04.44.1.0+git191117-2ubuntu0.20.04.54.1.0+git191117-2ubuntu0.20.04.64.1.0+git191117-2ubuntu0.20.04.74.1.0+git191117-2ubuntu0.20.04.84.1.0+git191117-2ubuntu0.20.04.94.1.0+git191117-2ubuntu0.20.04.104.1.0+git191117-2ubuntu0.20.04.114.1.0+git191117-2ubuntu0.20.04.124.1.0+git191117-2ubuntu0.20.04.134.1.0+git191117-2ubuntu0.20.04.144.1.0+git191117-2ubuntu0.20.04.14+esm1	4.1.0+git191117-2ubuntu0.20.04.14+esm2
`neuron` Ubuntu:20.04:LTS	All versions, plus listed versions 7.6.3-1build27.6.3-1build37.6.3-1build4	None known
`qtwebengine-opensource-src` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 5.12.4+dfsg-1ubuntu15.12.4+dfsg-1ubuntu35.12.5+dfsg-3ubuntu15.12.5+dfsg-6ubuntu25.12.5+dfsg-7 Show 4 moreShow less 5.12.5+dfsg-7build15.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu1.15.12.8+dfsg-0ubuntu1.1+esm1	None known
`texmaker` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 5.0.3-1build25.0.3-1build35.0.3-1build45.0.3-1build55.0.3-1ubuntu0.20.04.1~esm1	None known
`neuron` Ubuntu:22.04:LTS	All versions, plus listed versions 7.6.3-1build57.6.3-1build6	None known
`tiff` Ubuntu:22.04:LTS	before 4.3.0-6ubuntu0.12, plus listed versions 4.3.0-14.3.0-24.3.0-34.3.0-3build14.3.0-4 Show 13 moreShow less 4.3.0-54.3.0-64.3.0-6ubuntu0.14.3.0-6ubuntu0.24.3.0-6ubuntu0.34.3.0-6ubuntu0.44.3.0-6ubuntu0.54.3.0-6ubuntu0.64.3.0-6ubuntu0.74.3.0-6ubuntu0.84.3.0-6ubuntu0.94.3.0-6ubuntu0.104.3.0-6ubuntu0.11	4.3.0-6ubuntu0.12
`qtwebengine-opensource-src` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 5.15.6+dfsg-15.15.6+dfsg-25.15.7+dfsg-25.15.8+dfsg-15.15.8+dfsg-1build1 Show 4 moreShow less 5.15.8+dfsg-1build25.15.8+dfsg-25.15.9+dfsg-15.15.9+dfsg-1ubuntu0.1~esm1	None known
`texmaker` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 5.0.3-1build85.0.3-1build95.0.3-1ubuntu0.22.04.1~esm1	None known
`tiff` Ubuntu:24.04:LTS	before 4.5.1+git230720-4ubuntu2.4, plus listed versions 4.5.1+git230720-1ubuntu14.5.1+git230720-3ubuntu14.5.1+git230720-4ubuntu14.5.1+git230720-4ubuntu24.5.1+git230720-4ubuntu2.14.5.1+git230720-4ubuntu2.24.5.1+git230720-4ubuntu2.3	4.5.1+git230720-4ubuntu2.4
`qtwebengine-opensource-src` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 5.15.15+dfsg-25.15.15+dfsg-2build25.15.15+dfsg-2ubuntu15.15.16+dfsg-15.15.16+dfsg-1ubuntu25.15.16+dfsg-1ubuntu45.15.16+dfsg-35.15.16+dfsg-3ubuntu0.1~esm1	None known
`texmaker` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 5.1.3+dfsg-1build45.1.3+dfsg-1build55.1.3+dfsg-1build65.1.3+dfsg-1build75.1.3+dfsg-1build85.1.3+dfsg-1ubuntu0.1~esm1	None known
`qtwebengine-opensource-src` Ubuntu:25.10	All versions, plus listed versions 5.15.18+dfsg-25.15.18+dfsg-2build15.15.19+dfsg-15.15.19+dfsg2-1	None known
`texmaker` Ubuntu:25.10	All versions, plus listed versions 5.1.3+dfsg-35.1.3+dfsg-3build1	None known
`tiff` Ubuntu:25.10	before 4.7.0-3ubuntu3, plus listed versions 4.5.1+git230720-4ubuntu44.7.0-3ubuntu14.7.0-3ubuntu2	4.7.0-3ubuntu3
`qtwebengine-opensource-src` Ubuntu:26.10	All versions, plus listed versions 5.15.19+dfsg2-45.15.19+dfsg2-65.15.19+dfsg2-7	None known
`tiff` Ubuntu:26.04:LTS	before 4.7.0-3ubuntu3	4.7.0-3ubuntu3
`qtwebengine-opensource-src` Ubuntu:Pro:26.04:LTS	All versions, plus listed versions 5.15.19+dfsg2-15.15.19+dfsg2-1build15.15.19+dfsg2-25.15.19+dfsg2-35.15.19+dfsg2-45.15.19+dfsg2-4ubuntu0.1~esm1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-61145 is a medium vulnerability (CVSS 5.0) in Libtiff, published February 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. Fixed in libtiff 4.6.0-11.

References

Show 37 moreShow less