The libtiff library in Red Hat Enterprise Linux 9.2 contains two security vulnerabilities: CVE-2025-8176, a use-after-free vulnerability, and CVE-2025-9900, a write-what-where vulnerability. Both issues could lead to memory corruption or arbitrary code execution if exploited. Red Hat has released updated libtiff packages (version 4.4.0-8.el9_2.4) to address these vulnerabilities. The advisory covers multiple architectures including x86_64, ppc64le, aarch64, and s390x. The vendor rates the security impact as Important and recommends applying the update. No CVSS base scores are provided in the advisory, and no exploits are currently known in the wild.

Successful exploitation of these vulnerabilities could allow an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution. The use-after-free and write-what-where conditions are serious memory safety issues that can undermine system stability and security. However, no known exploits have been reported in the wild so far.

Red Hat has released updated libtiff packages (libtiff-4.4.0-8.el9_2.4) for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and related variants. Applying these official updates will remediate the vulnerabilities. Administrators should follow Red Hat's published guidance at https://access.redhat.com/articles/11258 to apply the patches. No additional mitigation actions are specified or required beyond applying the vendor-provided update.