CVE-2025-61145: 
NixOS vulnerability analysis and mitigation

CVE-2025-61145 is a double free vulnerability in libtiff up to and including version 4.7.1, located in the tools/tiffcrop.c component. The flaw was disclosed on February 23, 2026, and affects all libtiff releases through v4.7.1. It carries a CVSS v3.1 base score of 5.0 (Medium), requiring local access, low privileges, and user interaction to exploit (Feedly, GitLab Issue).

The vulnerability is classified as CWE-415 (Double Free), occurring when the same memory block is freed twice during execution within the tiffcrop tool's processing logic in tools/tiffcrop.c. An attacker must supply a specially crafted TIFF file to a user running the tiffcrop utility, triggering the erroneous double-free condition. A proof-of-concept and a corresponding merge request addressing the issue have been published on the libtiff GitLab repository (GitLab Issue, GitLab MR).

Successful exploitation causes a denial of service by crashing the tiffcrop application, potentially leading to system instability when processing malicious TIFF files. There is no impact on confidentiality or integrity — only availability is affected. The scope is limited to the local system and the process running tiffcrop, with no evidence of lateral movement potential (Feedly).

A proof-of-concept is publicly available via the libtiff GitLab issue tracker, referenced as an exploit by NVD. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is very low at approximately 0.017%, reflecting limited exploitation likelihood. Exploitation requires local access, low privileges, and user interaction (i.e., a user must open a crafted TIFF file with tiffcrop) (GitLab Issue, Feedly).

1. Craft a malicious TIFF file: Create a specially crafted TIFF file designed to trigger the double-free condition in tiffcrop's memory management logic within tools/tiffcrop.c.
2. Deliver the file to the target: Use social engineering or file-sharing mechanisms to get a local user on the target system to process the crafted TIFF file.
3. Trigger execution: Induce the target user to run tiffcrop against the malicious file (e.g., tiffcrop malicious.tiff output.tiff).
4. Achieve denial of service: The double-free condition is triggered during processing, causing the tiffcrop process to crash, resulting in application termination or potential system instability (GitLab Issue).

• Process: Unexpected crash or abnormal termination of the tiffcrop process when processing a TIFF file.
• Logs: Application crash logs or core dump files generated by tiffcrop (e.g., core files in the working directory); system logs (e.g., /var/log/syslog) showing segmentation fault or double-free errors from the tiffcrop process.
• File System: Presence of unusual or unexpected TIFF files submitted for processing; core dump files (e.g., core.tiffcrop.<pid>) in the working directory.

Update libtiff to a version newer than 4.7.1 once a patched release is available; a fix has been proposed via GitLab merge request #753. Until patching is possible, disable or restrict use of the tiffcrop tool if it is not operationally required. Additionally, restrict local user permissions on systems that process TIFF files and implement input validation to reject untrusted TIFF files before processing (GitLab MR, Feedly). Amazon Linux 2 users can refer to the ALAS advisory for distribution-specific guidance (AWS ALAS).

The Yocto Project security mailing list has discussed the vulnerability in the context of embedded Linux distributions, indicating awareness in the embedded systems community (Yocto Security). Tenable has published Nessus detection plugins (IDs 299837 and 303084) for this vulnerability, and Microsoft's MSRC has also catalogued it. No significant public researcher commentary or media coverage has been identified beyond standard vulnerability tracking.