The libtiff library in Red Hat Enterprise Linux 9.4 Extended Update Support and related variants contains two security vulnerabilities: a Use-After-Free vulnerability (CVE-2025-8176) and a Write-What-Where vulnerability (CVE-2025-9900). These vulnerabilities could potentially allow an attacker to manipulate memory in unintended ways. Red Hat Product Security has issued an advisory (RHSA-2025:21507) and released updated libtiff packages to fix these issues. The advisory rates the security impact as Important and provides instructions for applying the update. The affected products include multiple architectures and variants of Red Hat Enterprise Linux 9.4 and Red Hat CodeReady Linux Builder 9.4.

The identified vulnerabilities in libtiff could lead to memory corruption issues such as use-after-free and arbitrary write conditions, which may be exploitable to cause application crashes or potentially execute arbitrary code. Red Hat rates the security impact as Important, indicating a significant risk if unpatched. There are no known exploits in the wild at the time of the advisory. The vulnerabilities affect multiple architectures and variants of Red Hat Enterprise Linux 9.4 and related products.

Red Hat has released updated libtiff packages that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2025:21507 and the referenced article https://access.redhat.com/articles/11258. Applying this update will remediate the Use-After-Free and Write-What-Where vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.