CVE-2025-8961

What it actually does

Local memory corruption triggered by manipulated input to the main function in tiffcrop.c within LibTIFF 4.7.0, resulting in application instability or crashes without remote vector or privilege escalation.

Why it matters to the business

Limited operational disruption possible when processing untrusted image files locally in affected container registry tools, with low likelihood of widespread exploitation given the local attack requirement and modest EPSS score showing only minor upward trend.

How an attack unfolds

An attacker with local system access prepares a crafted TIFF file and runs the tiffcrop utility to trigger memory corruption in the main function; public exploit availability increases risk for local abuse but no named threat actors or ransomware campaigns are associated.

How to fix it

Upgrade zot (Chainguard) to version 2.1.7-r3 or later and zot (Wolfi) to version 2.1.7-r3 or later; apply updates promptly across all instances to resolve the underlying LibTIFF memory corruption issue.

How to confirm the fix worked

Confirm package versions meet or exceed the fixed releases for zot on Chainguard and Wolfi; retest image processing workflows with untrusted TIFF inputs to verify stability.

Typical attack path

1. Gain local access to a host running vulnerable LibTIFF-based tooling
2. Craft or obtain a malicious TIFF image file
3. Invoke tiffcrop against the file to trigger the flaw in main
4. Observe resulting memory corruption effects such as crashes

How to detect it

Examine system and application logs for tiffcrop process crashes or segmentation faults when handling TIFF files; monitor command-line executions involving tiffcrop with external or untrusted file paths.

What your security team should do

• Apply the specified zot upgrades to 2.1.7-r3 across environments without delay
• Audit local execution of tiffcrop and similar utilities for untrusted inputs
• Review system logs for unexpected process terminations related to image tools