CVE-2025-8851

What it actually does

Stack-based buffer overflow in the readSeparateStripsetoBuffer function of tiffcrop.c caused by improper handling of input data leading to out-of-bounds writes on the stack.

Why it matters to the business

Local attackers can crash the tiffcrop utility or potentially execute arbitrary code on systems processing untrusted TIFF images, disrupting image conversion and cropping workflows with low but non-zero risk of privilege escalation.

How an attack unfolds

An attacker with local access crafts a malicious TIFF file that triggers excessive data copying into a fixed-size stack buffer inside readSeparateStripsetoBuffer when tiffcrop processes the file; successful overflow can overwrite return addresses or control data to achieve code execution under the privileges of the invoking user.

How to fix it

Update libtiff to the commit 8a7a48d7a645992ca83062b3a1873c951661e2b3 or later; rebuild tiffcrop and any dependent tools; replace all installations of versions up to 4.5.1 with the patched release.

How to confirm the fix worked

Verify the installed libtiff source contains commit 8a7a48d7a645992ca83062b3a1873c951661e2b3 in tiffcrop.c; run regression tests with known-good and boundary-case TIFF files; confirm absence of the vulnerable readSeparateStripsetoBuffer implementation via code review or binary diff.

Typical attack path

1. Identify or obtain local access to a system with tiffcrop installed
2. Craft or obtain a specially malformed TIFF image targeting the separate strips code path
3. Invoke tiffcrop on the malicious file via command line or script
4. Trigger the buffer overflow during strip processing to corrupt stack memory
5. Leverage control-flow hijacking for code execution or denial of service

How to detect it

Review command-line audit logs and process execution records for unexpected tiffcrop invocations on untrusted TIFF inputs; inspect core dumps or crash reports containing stack traces referencing tiffcrop.c; correlate with file creation or download events preceding crashes.

What your security team should do

• Immediately patch all libtiff installations to the referenced commit or newer release
• Remove or restrict execute permissions on tiffcrop for untrusted users where possible
• Scan build pipelines and containers for affected libtiff versions and rebuild them
• Monitor EPSS trend and reassess if public exploits emerge