CVE-2025-61144: 
NixOS vulnerability analysis and mitigation

CVE-2025-61144 is a stack overflow vulnerability in libtiff up to and including version 4.7.1, triggered via the readSeparateStripsIntoBuffer function when processing specially crafted TIFF files. It was disclosed on February 23, 2026, with patches committed to the libtiff GitLab repository shortly after. The vulnerability carries a CVSS v3.1 base score of 7.3 (High), requiring low privileges and user interaction, with a local attack vector (Feedly, Microsoft MSRC).

The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a stack overflow in the readSeparateStripsIntoBuffer function within libtiff (Feedly). An attacker crafts a malicious TIFF file that, when processed by an application using the vulnerable libtiff library, causes the function to write beyond the bounds of a stack-allocated buffer. Exploitation requires a local attacker with low privileges to induce a user or process to open the malicious file. The issue was reported via the libtiff GitLab issue tracker and addressed in two separate commits (GitHub Gist, libtiff commit 1, libtiff commit 2).

Successful exploitation can result in denial of service via application crash, potential arbitrary code execution if the attacker can control stack memory overwrite to redirect execution flow, or information disclosure through memory corruption (Feedly). Any system or application that processes untrusted TIFF files using libtiff versions up to 4.7.1 is at risk, including image viewers, document converters, and server-side media processing pipelines. The confidentiality, integrity, and availability impacts are all rated High per the CVSS scoring.

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is very low at approximately 0.018%, reflecting limited current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A GitLab issue (#740) serves as the primary public reference for the bug report (libtiff issue).

1. Craft a malicious TIFF file: Create a specially crafted TIFF file with malformed strip data designed to trigger a stack overflow in the readSeparateStripsIntoBuffer function when parsed by libtiff.
2. Deliver the file: Deliver the malicious TIFF to a target system via email attachment, file share, web upload, or other means, targeting an application that uses libtiff for image processing.
3. Trigger processing: Induce a user or automated process (e.g., image viewer, document converter, thumbnail generator) to open or process the malicious TIFF file.
4. Achieve impact: The stack overflow is triggered during strip buffer reading, potentially causing an application crash (DoS) or, if memory layout permits, overwriting return addresses or function pointers to redirect execution and achieve arbitrary code execution (libtiff issue, Feedly).

• Process: Unexpected crashes or segmentation faults in applications that process TIFF files (e.g., image viewers, converters, thumbnail services) linked against libtiff.
• Logs: Application crash logs or core dumps referencing readSeparateStripsIntoBuffer in the stack trace; error messages from libtiff indicating malformed TIFF data.
• File System: Presence of suspicious or unexpected TIFF files in upload directories, temporary folders, or user download locations.
• Network: Unusual inbound file transfers of TIFF files to services that process images automatically, particularly from untrusted or external sources.

The libtiff project has released patches addressing this vulnerability via two commits to the main repository (commits 09f53a86 and 88cf9dbb); users should upgrade to a version of libtiff that includes these fixes, beyond v4.7.1 (libtiff commit 1, libtiff commit 2). Distribution-specific updates have been issued for Ubuntu, SUSE, Amazon Linux 2, and Mageia, among others. As interim mitigations: restrict processing of TIFF files from untrusted sources, sandbox image-processing operations with minimal privileges, and implement file format validation before passing files to libtiff-based applications (Feedly).

Microsoft acknowledged the vulnerability through its Security Response Center advisory page, indicating relevance to Microsoft products shipping libtiff (e.g., Azure Linux packages azl3_libtiff_4.6.0-11 and cbl2_libtiff_4.6.0-11) (Microsoft MSRC). Multiple Linux distributions including Ubuntu, SUSE, Amazon Linux, and Mageia issued security advisories and updated packages. Security scanner vendors Tenable (Nessus) and Qualys added detection plugins for the vulnerability shortly after disclosure.