CVE-2025-9900 is a write-what-where condition vulnerability in the libtiff3 library, an older version of the libtiff library used for manipulating TIFF image files. The vulnerability occurs when processing a TIFF image with an abnormally large image height metadata value, which causes the library to write attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause application crashes or arbitrary code execution with the permissions of the user running the application. Red Hat has released security advisories (RHSA-2025:17651 and RHSA-2025:17675) providing updated compat-libtiff3 packages that fix this vulnerability in Red Hat Enterprise Linux 8 and its Extended Update Support and Extended Life Cycle versions. The advisories include detailed package versions and instructions for applying the updates.

Successful exploitation of this vulnerability allows an attacker to cause a denial of service (application crash) or execute arbitrary code with the privileges of the user running the vulnerable application. The CVSS v3.1 base score is 8.8 (high severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Red Hat has released official security updates for compat-libtiff3 packages that address CVE-2025-9900. Users should apply the updates provided in advisories RHSA-2025:17651 and RHSA-2025:17675 for Red Hat Enterprise Linux 8 and related Extended Update Support and Extended Life Cycle versions. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates mitigates the vulnerability. No additional mitigation steps are indicated by the vendor.