# CVE-2025-8176: LibTIFF tiffmedian.c get_histogram use after free CVE-2025-8176 is fixed in 19 products on 1 platform, first by DEBIAN-CVE-2025-8176, released July 26, 2025. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2025-8176 - Priority: High - CVSS: 8.8 (Low) - EPSS: 0.0029 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jul 25, 2025 - Weakness: Use After Free - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-8176 ## Description A vulnerability was found in LibTIFF up to 4.7.0. It has been declared ascritical. This vulnerability affects the function get_histogram of the filetools/tiffmedian.c. The manipulation leads to use after free. The attackneeds to be approached locally. The exploit has been disclosed to thepublic and may be used. The patch is identified asfe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply apatch to fix this issue. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libtiff RHEL 8 | 0:4.0.9-36.el8_10 | [RHSA-2025:20034](https://patchblox.com/security/data/fix/linux/rhsa-2025-20034.md) | Nov 10, 2025 | | Linux | libtiff RHEL 9 | 0:4.4.0-15.el9_7.2 | [RHSA-2025:20956](https://patchblox.com/security/data/fix/linux/rhsa-2025-20956.md) | Nov 11, 2025 | | Linux | libtiff almalinux 8 | 4.0.9-36.el8_10 | [ALSA-2025:20034](https://patchblox.com/security/data/fix/linux/alsa-2025-20034.md) | Nov 10, 2025 | | Linux | libtiff almalinux 9 | 4.4.0-15.el9_7.2 | [ALSA-2025:20956](https://patchblox.com/security/data/fix/linux/alsa-2025-20956.md) | Nov 11, 2025 | | Linux | libtiff amzn 2023 | 4.4.0-4.amzn2023.0.20 | [ALAS2023-2025-1153](https://patchblox.com/security/data/fix/linux/alas2023-2025-1153.md) | Aug 18, 2025 | | Linux | libtiff ol 8 | 0:4.0.9-36.el8_10 | [ELSA-2025-20034-0](https://patchblox.com/security/data/fix/linux/elsa-2025-20034-0.md) | Nov 10, 2025 | | Linux | libtiff ol 9 | 0:4.4.0-13.el9_6.2 | [ELSA-2025-19113](https://patchblox.com/security/data/fix/linux/elsa-2025-19113.md) | Oct 28, 2025 | | Linux | libtiff rocky 8 | 0:4.0.9-36.el8_10 | [RLSA-2025:20034](https://patchblox.com/security/data/fix/linux/rlsa-2025-20034.md) | Nov 11, 2025 | | Linux | libtiff rocky 9 | 0:4.4.0-15.el9_7.2.0.1 | [RLSA-2025:20956](https://patchblox.com/security/data/fix/linux/rlsa-2025-20956.md) | May 21, 2026 | | Linux | libtiff-debuginfo amzn 2023 | 4.4.0-4.amzn2023.0.20 | [ALAS2023-2025-1153](https://patchblox.com/security/data/fix/linux/alas2023-2025-1153.md) | Aug 18, 2025 | | Linux | libtiff-debugsource amzn 2023 | 4.4.0-4.amzn2023.0.20 | [ALAS2023-2025-1153](https://patchblox.com/security/data/fix/linux/alas2023-2025-1153.md) | Aug 18, 2025 | | Linux | libtiff-devel RHEL 8 | 0:4.0.9-36.el8_10 | [RHSA-2025:20034](https://patchblox.com/security/data/fix/linux/rhsa-2025-20034.md) | Nov 10, 2025 | | Linux | libtiff-devel RHEL 9 | 0:4.4.0-15.el9_7.2 | [RHSA-2025:20956](https://patchblox.com/security/data/fix/linux/rhsa-2025-20956.md) | Nov 11, 2025 | | Linux | libtiff-devel almalinux 8 | 4.0.9-36.el8_10 | [ALSA-2025:20034](https://patchblox.com/security/data/fix/linux/alsa-2025-20034.md) | Nov 10, 2025 | | Linux | libtiff-devel almalinux 9 | 4.4.0-15.el9_7.2 | [ALSA-2025:20956](https://patchblox.com/security/data/fix/linux/alsa-2025-20956.md) | Nov 11, 2025 | | Linux | libtiff-devel amzn 2023 | 4.4.0-4.amzn2023.0.20 | [ALAS2023-2025-1153](https://patchblox.com/security/data/fix/linux/alas2023-2025-1153.md) | Aug 18, 2025 | | Linux | libtiff-devel ol 8 | 0:4.0.9-36.el8_10 | [ELSA-2025-20034-0](https://patchblox.com/security/data/fix/linux/elsa-2025-20034-0.md) | Nov 10, 2025 | | Linux | libtiff-devel ol 9 | 0:4.4.0-13.el9_6.2 | [ELSA-2025-19113](https://patchblox.com/security/data/fix/linux/elsa-2025-19113.md) | Oct 28, 2025 | | Linux | libtiff-opengl Ubuntu 18.04.6 LTS (bionic) | 4.0.9-5ubuntu0.10+esm8 | [libtiff-opengl 4.0.9-5ubuntu0.10+esm8](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libtiff-opengl-4.0.9-5ubuntu0.10-esm8.md) | Aug 11, 2025 | | Linux | libtiff-opengl Ubuntu 20.04 LTS (focal) | 4.1.0+git191117-2ubuntu0.20.04.14+esm1 | [libtiff-opengl 4.1.0+git191117-2ubuntu0.20.04.14+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libtiff-opengl-4.1.0-git191117-2ubuntu0.20.04.14-esm1.md) | Aug 11, 2025 | | Linux | libtiff-opengl Ubuntu 22.04.1 LTS (jammy) | 4.3.0-6ubuntu0.11 | [libtiff-opengl 4.3.0-6ubuntu0.11](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libtiff-opengl-4.3.0-6ubuntu0.11.md) | Aug 11, 2025 | | Linux | libtiff-opengl Ubuntu 24.04.5 LTS (noble) | 4.5.1+git230720-4ubuntu2.3 | [libtiff-opengl 4.5.1+git230720-4ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libtiff-opengl-4.5.1-git230720-4ubuntu2.3.md) | Aug 11, 2025 | | Linux | libtiff-opengl Ubuntu 25.04 (plucky) | 4.5.1+git230720-4ubuntu4.1 | [libtiff-opengl 4.5.1+git230720-4ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libtiff-opengl-4.5.1-git230720-4ubuntu4.1.md) | Jan 16, 2026 | | Linux | libtiff-static amzn 2023 | 4.4.0-4.amzn2023.0.20 | [ALAS2023-2025-1153](https://patchblox.com/security/data/fix/linux/alas2023-2025-1153.md) | Aug 18, 2025 | | Linux | libtiff-tools RHEL 8 | 0:4.0.9-36.el8_10 | [RHSA-2025:20034](https://patchblox.com/security/data/fix/linux/rhsa-2025-20034.md) | Nov 10, 2025 | | Linux | libtiff-tools RHEL 9 | 0:4.4.0-15.el9_7.2 | [RHSA-2025:20956](https://patchblox.com/security/data/fix/linux/rhsa-2025-20956.md) | Nov 11, 2025 | | Linux | libtiff-tools Ubuntu 18.04.6 LTS (bionic) | 4.0.9-5ubuntu0.10+esm8 | [libtiff-tools 4.0.9-5ubuntu0.10+esm8](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libtiff-tools-4.0.9-5ubuntu0.10-esm8.md) | Aug 11, 2025 | | Linux | libtiff-tools Ubuntu 20.04 LTS (focal) | 4.1.0+git191117-2ubuntu0.20.04.14+esm1 | [libtiff-tools 4.1.0+git191117-2ubuntu0.20.04.14+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libtiff-tools-4.1.0-git191117-2ubuntu0.20.04.14-esm1.md) | Aug 11, 2025 | | Linux | libtiff-tools Ubuntu 22.04.1 LTS (jammy) | 4.3.0-6ubuntu0.11 | [libtiff-tools 4.3.0-6ubuntu0.11](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libtiff-tools-4.3.0-6ubuntu0.11.md) | Aug 11, 2025 | | Linux | libtiff-tools Ubuntu 24.04.5 LTS (noble) | 4.5.1+git230720-4ubuntu2.3 | [libtiff-tools 4.5.1+git230720-4ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libtiff-tools-4.5.1-git230720-4ubuntu2.3.md) | Aug 11, 2025 | | Linux | libtiff-tools Ubuntu 25.04 (plucky) | 4.5.1+git230720-4ubuntu4.1 | [libtiff-tools 4.5.1+git230720-4ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libtiff-tools-4.5.1-git230720-4ubuntu4.1.md) | Jan 16, 2026 | | Linux | libtiff-tools almalinux 8 | 4.0.9-36.el8_10 | [ALSA-2025:20034](https://patchblox.com/security/data/fix/linux/alsa-2025-20034.md) | Nov 10, 2025 | | Linux | libtiff-tools almalinux 9 | 4.4.0-15.el9_7.2 | [ALSA-2025:20956](https://patchblox.com/security/data/fix/linux/alsa-2025-20956.md) | Nov 11, 2025 | | Linux | libtiff-tools amzn 2023 | 4.4.0-4.amzn2023.0.20 | [ALAS2023-2025-1153](https://patchblox.com/security/data/fix/linux/alas2023-2025-1153.md) | Aug 18, 2025 | | Linux | libtiff-tools ol 8 | 0:4.0.9-36.el8_10 | [ELSA-2025-20034-0](https://patchblox.com/security/data/fix/linux/elsa-2025-20034-0.md) | Nov 10, 2025 | | Linux | libtiff-tools ol 9 | 0:4.4.0-13.el9_6.2 | [ELSA-2025-19113](https://patchblox.com/security/data/fix/linux/elsa-2025-19113.md) | Oct 28, 2025 | | Linux | libtiff-tools-debuginfo amzn 2023 | 4.4.0-4.amzn2023.0.20 | [ALAS2023-2025-1153](https://patchblox.com/security/data/fix/linux/alas2023-2025-1153.md) | Aug 18, 2025 | | Linux | libtiff5 Ubuntu 18.04.6 LTS (bionic) | 4.0.9-5ubuntu0.10+esm8 | [libtiff5 4.0.9-5ubuntu0.10+esm8](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libtiff5-4.0.9-5ubuntu0.10-esm8.md) | Aug 11, 2025 | | Linux | libtiff5 Ubuntu 20.04 LTS (focal) | 4.1.0+git191117-2ubuntu0.20.04.14+esm1 | [libtiff5 4.1.0+git191117-2ubuntu0.20.04.14+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libtiff5-4.1.0-git191117-2ubuntu0.20.04.14-esm1.md) | Aug 11, 2025 | | Linux | libtiff5 Ubuntu 22.04.1 LTS (jammy) | 4.3.0-6ubuntu0.11 | [libtiff5 4.3.0-6ubuntu0.11](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libtiff5-4.3.0-6ubuntu0.11.md) | Aug 11, 2025 | | Linux | libtiff6 Ubuntu 24.04.5 LTS (noble) | 4.5.1+git230720-4ubuntu2.3 | [libtiff6 4.5.1+git230720-4ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libtiff6-4.5.1-git230720-4ubuntu2.3.md) | Aug 11, 2025 | | Linux | libtiff6 Ubuntu 25.04 (plucky) | 4.5.1+git230720-4ubuntu4.1 | [libtiff6 4.5.1+git230720-4ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libtiff6-4.5.1-git230720-4ubuntu4.1.md) | Jan 16, 2026 | | Linux | libtiffxx5 Ubuntu 18.04.6 LTS (bionic) | 4.0.9-5ubuntu0.10+esm8 | [libtiffxx5 4.0.9-5ubuntu0.10+esm8](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libtiffxx5-4.0.9-5ubuntu0.10-esm8.md) | Aug 11, 2025 | | Linux | libtiffxx5 Ubuntu 20.04 LTS (focal) | 4.1.0+git191117-2ubuntu0.20.04.14+esm1 | [libtiffxx5 4.1.0+git191117-2ubuntu0.20.04.14+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libtiffxx5-4.1.0-git191117-2ubuntu0.20.04.14-esm1.md) | Aug 11, 2025 | | Linux | libtiffxx5 Ubuntu 22.04.1 LTS (jammy) | 4.3.0-6ubuntu0.11 | [libtiffxx5 4.3.0-6ubuntu0.11](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libtiffxx5-4.3.0-6ubuntu0.11.md) | Aug 11, 2025 | | Linux | libtiffxx6 Ubuntu 24.04.5 LTS (noble) | 4.5.1+git230720-4ubuntu2.3 | [libtiffxx6 4.5.1+git230720-4ubuntu2.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libtiffxx6-4.5.1-git230720-4ubuntu2.3.md) | Aug 11, 2025 | | Linux | libtiffxx6 Ubuntu 25.04 (plucky) | 4.5.1+git230720-4ubuntu4.1 | [libtiffxx6 4.5.1+git230720-4ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libtiffxx6-4.5.1-git230720-4ubuntu4.1.md) | Jan 16, 2026 | | Linux | mingw-libtiff rocky 8 | 0:4.0.9-3.el8_10 | [RLSA-2025:19906](https://patchblox.com/security/data/fix/linux/rlsa-2025-19906.md) | Nov 7, 2025 | | Linux | mingw32-libtiff RHEL 8 | 0:4.0.9-3.el8_10 | [RHSA-2025:19906](https://patchblox.com/security/data/fix/linux/rhsa-2025-19906.md) | Nov 6, 2025 | | Linux | mingw32-libtiff almalinux 8 | 4.0.9-3.el8_10 | [ALSA-2025:19906](https://patchblox.com/security/data/fix/linux/alsa-2025-19906.md) | Nov 6, 2025 | | Linux | mingw32-libtiff ol 8 | 0:4.0.9-3.el8_10 | [ELSA-2025-19906](https://patchblox.com/security/data/fix/linux/elsa-2025-19906.md) | Nov 7, 2025 | | Linux | mingw32-libtiff-static RHEL 8 | 0:4.0.9-3.el8_10 | [RHSA-2025:19906](https://patchblox.com/security/data/fix/linux/rhsa-2025-19906.md) | Nov 6, 2025 | | Linux | mingw32-libtiff-static almalinux 8 | 4.0.9-3.el8_10 | [ALSA-2025:19906](https://patchblox.com/security/data/fix/linux/alsa-2025-19906.md) | Nov 6, 2025 | | Linux | mingw32-libtiff-static ol 8 | 0:4.0.9-3.el8_10 | [ELSA-2025-19906](https://patchblox.com/security/data/fix/linux/elsa-2025-19906.md) | Nov 7, 2025 | | Linux | mingw64-libtiff RHEL 8 | 0:4.0.9-3.el8_10 | [RHSA-2025:19906](https://patchblox.com/security/data/fix/linux/rhsa-2025-19906.md) | Nov 6, 2025 | | Linux | mingw64-libtiff almalinux 8 | 4.0.9-3.el8_10 | [ALSA-2025:19906](https://patchblox.com/security/data/fix/linux/alsa-2025-19906.md) | Nov 6, 2025 | | Linux | mingw64-libtiff ol 8 | 0:4.0.9-3.el8_10 | [ELSA-2025-19906](https://patchblox.com/security/data/fix/linux/elsa-2025-19906.md) | Nov 7, 2025 | | Linux | mingw64-libtiff-static RHEL 8 | 0:4.0.9-3.el8_10 | [RHSA-2025:19906](https://patchblox.com/security/data/fix/linux/rhsa-2025-19906.md) | Nov 6, 2025 | | Linux | mingw64-libtiff-static almalinux 8 | 4.0.9-3.el8_10 | [ALSA-2025:19906](https://patchblox.com/security/data/fix/linux/alsa-2025-19906.md) | Nov 6, 2025 | | Linux | mingw64-libtiff-static ol 8 | 0:4.0.9-3.el8_10 | [ELSA-2025-19906](https://patchblox.com/security/data/fix/linux/elsa-2025-19906.md) | Nov 7, 2025 | | Linux | tiff Debian 14 | 4.7.1-1 | [DEBIAN-CVE-2025-8176](https://patchblox.com/security/data/fix/linux/debian-cve-2025-8176.md) | Jul 26, 2025 | | Linux | tiff opensuse-leap 15.6 | 4.7.0-150600.3.13.1 | [SUSE-SU-2025:02770-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02770-1.md) | Aug 12, 2025 | | Linux | tiff opensuse-leap 16.0 | 4.7.1-160000.1.1 | [OPENSUSE-SU-2025:20049-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2025-20049-1.md) | Nov 19, 2025 | | Linux | tiff sles 15.6 | 4.0.9-150000.45.50.1 | [SUSE-SU-2025:02815-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02815-1.md) | Aug 15, 2025 | | Linux | tiff sles 15.7 | 4.0.9-150000.45.50.1 | [SUSE-SU-2025:02815-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02815-1.md) | Aug 15, 2025 | | Linux | tiff sles 16.0 | 4.7.1-160000.1.1 | [SUSE-SU-2025:21009-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-21009-1.md) | Nov 19, 2025 | | Linux | tiff-man opensuse-leap 16.0 | 4.7.1-160000.1.1 | [OPENSUSE-SU-2025:20049-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2025-20049-1.md) | Nov 19, 2025 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.