CVE-2025-61144
Published: 23 February 2026
Summary
CVE-2025-61144 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Libtiff Libtiff. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 16.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-61144 is a stack overflow vulnerability affecting the libtiff library in versions up to and including 4.7.1. The flaw occurs in the readSeparateStripsIntoBuffer function and is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Published on 2026-02-23, it carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by a local attacker with low privileges who tricks a user into processing a malicious TIFF file, requiring user interaction. Successful exploitation leads to high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution, data corruption, or denial of service on the affected system.
Libtiff advisories and patches are documented in GitLab issue #740 and merge request #757, with fixes applied in commits 09f53a86cf26dfd961925227e59e180db617f26d and 88cf9dbb48f6e172629795ecffae35d5052f68aa. Security practitioners should update libtiff to incorporate these patches and avoid processing untrusted TIFF files with vulnerable versions. Further technical details are available in the referenced GitHub gist.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207645
Vulnerability details
libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack overflow in image library enables client-side RCE via malicious TIFF file requiring user execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of vendor patches (such as the commits fixing readSeparateStripsIntoBuffer) to eliminate the stack overflow before exploitation.
Implements memory-protection safeguards that block unauthorized code execution resulting from the stack-based buffer overflow in libtiff.
Requires validation of input data (TIFF strips) to enforce buffer bounds and thereby stop the malformed input that triggers the overflow.