CVE-2025-9165

What it actually does

Memory leak triggered by local manipulation of specific allocation and hash functions in the tiffcmp command-line utility.

Why it matters to the business

Negligible operational effect; the issue occurs only in a local command-line tool that is about to exit and carries no confirmed remote or persistent risk.

How an attack unfolds

An attacker with local access would need to craft a specific input that reaches the affected allocation paths in tiffcmp, but the high complexity, disputed security relevance, and maintainer statement indicate no practical end-to-end attack is viable.

How to fix it

Update to the commit ed141286a37f6e5ddafb5069347ff5d587e7a4e0 or a later release that contains it.

How to confirm the fix worked

Verify the installed source contains commit ed141286a37f6e5ddafb5069347ff5d587e7a4e0 or run the patched tiffcmp binary against known test cases.

Typical attack path

1. Obtain local access to a system with the vulnerable tiffcmp binary
2. Supply a crafted TIFF input to trigger the allocation functions
3. Observe memory not being freed before process termination

How to detect it

Examine local process logs or memory profiling output around tiffcmp executions for repeated allocation without corresponding frees immediately prior to exit.

What your security team should do

• Apply the referenced commit during the next routine maintenance window
• Treat the finding as low priority given the disputed security impact and local-only scope
• Monitor upstream LibTIFF releases for any follow-up statements