CVE-2025-9165

Publication date 19 August 2025

Last updated 26 October 2026

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

2.5 · Low

Score breakdown

Description

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".

Read the notes from the security team

Why is this CVE low priority?

Only a memory leak in a command line tool

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
tiff 26.10 stonking
Fixed in 4.7.0-3ubuntu3
26.04 LTS resolute
Fixed in 4.7.0-3ubuntu3
25.10 questing
Fixed in 4.7.0-3ubuntu3
25.04 plucky
Fixed in 4.5.1+git230720-4ubuntu4.2
24.04 LTS noble
Fixed in 4.5.1+git230720-4ubuntu2.4
22.04 LTS jammy
Fixed in 4.3.0-6ubuntu0.12
20.04 LTS focal
Fixed in 4.1.0+git191117-2ubuntu0.20.04.14+esm2
18.04 LTS bionic
Fixed in 4.0.9-5ubuntu0.10+esm9
16.04 LTS xenial
Fixed in 4.0.6-1ubuntu0.8+esm19
14.04 LTS trusty
Fixed in 4.0.3-7ubuntu0.11+esm16
qtwebengine-opensource-src 26.10 stonking
Needs evaluation
26.04 LTS resolute
Needs evaluation
25.10 questing Ignored end of life, was needs-triage
25.04 plucky Ignored end of life, was needs-triage
24.04 LTS noble
Needs evaluation
22.04 LTS jammy
Needs evaluation
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
texmaker 26.10 stonking
Needs evaluation
26.04 LTS resolute
Needs evaluation
25.10 questing Ignored end of life, was needs-triage
25.04 plucky Ignored end of life, was needs-triage
24.04 LTS noble
Needs evaluation
22.04 LTS jammy
Needs evaluation
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation
gdal 26.10 stonking
Not affected
26.04 LTS resolute
Not affected
25.10 questing
Not affected
25.04 plucky
Not affected
24.04 LTS noble
Not affected
22.04 LTS jammy
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Needs evaluation
14.04 LTS trusty
Needs evaluation
neuron 26.10 stonking
Not affected
26.04 LTS resolute
Not affected
25.10 questing
Not affected
25.04 plucky
Not affected
24.04 LTS noble
Not affected
22.04 LTS jammy
Needs evaluation
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Notes

sbeattie

texmaker added an embedded copy of libtiff in bionic

mdeslaur

This is a memory leak in a command line tool, setting priority to low

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
tiff

Severity score breakdown

CVSS version:

Base score 1.1 · Low

Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Base score 2.5 · Low

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

References

Related Ubuntu Security Notices (USN)

    • USN-7783-1
    • LibTIFF vulnerabilities
    • 29 September 2025

Other references

Access our resources on patching vulnerabilities