CVE-2025-8534

What it actually does

Null pointer dereference in PS_Lvl2page within tiff2ps.c when DEFER_STRILE_LOAD or TIFFOpen rD mode is active, resulting in local denial of service.

Why it matters to the business

Limited operational disruption possible on systems that invoke tiff2ps under the noted build or open options; low likelihood and high attack complexity reduce immediate risk.

How an attack unfolds

An attacker with local access supplies a specially crafted TIFF file to the tiff2ps utility while the vulnerable libtiff instance is built or opened with deferred strile loading enabled, triggering the null dereference and crash.

How to fix it

Apply commit 6ba36f159fd396ad11bf6b7874554197736ecc8b or later; rebuild libtiff and any dependent packages; avoid DEFER_STRILE_LOAD and rD open mode until patched.

How to confirm the fix worked

Confirm presence of the referenced commit in the source tree; test tiff2ps execution with DEFER_STRILE_LOAD enabled against both benign and malformed TIFF samples to verify no crash occurs.

Typical attack path

1. Identify or compile libtiff with DEFER_STRILE_LOAD=ON or use TIFFOpen rD mode
2. Craft or obtain a TIFF image that reaches PS_Lvl2page without valid strile data
3. Invoke tiff2ps on the crafted file from a local account
4. Trigger null dereference and application termination

How to detect it

Review process execution logs and command-line history for invocations of tiff2ps with unusual TIFF inputs; correlate any unexpected crashes of tiff2ps or dependent tools with file access timestamps.

What your security team should do

• Prioritize patching libtiff in build pipelines and container images within standard change windows
• Audit internal code and scripts for use of DEFER_STRILE_LOAD or rD open flags
• Monitor upstream libtiff releases for any follow-on fixes