CVE-2025-9900 is a write-what-where condition vulnerability in libtiff, triggered when processing a TIFF image file with an abnormally large image height value. This causes the library to write attacker-controlled color data to arbitrary memory locations, potentially leading to memory corruption. The impact includes denial of service (application crash) or arbitrary code execution with the privileges of the user running the application. The vulnerability requires user interaction to trigger. Red Hat has classified this issue as important but currently does not provide a mitigation or patch that meets their standards for ease of use, applicability, or stability. The vulnerability affects Red Hat Hardened Images and related libtiff RPMs. The CVSS v3.1 score assigned by Red Hat is 8.8 (high severity). Additional related CVEs (CVE-2025-61143, CVE-2025-61144, CVE-2025-61145) are also noted in the advisory.

Successful exploitation allows an attacker to overwrite arbitrary memory locations, leading to denial of service or arbitrary code execution with the permissions of the user running the vulnerable library. This can compromise confidentiality, integrity, and availability of the affected system. The attack requires that the user open a malicious TIFF image file, so it is not exploitable remotely without user interaction.

Red Hat currently does not offer a mitigation or patch that meets their criteria for ease of deployment, applicability, or stability. Users should exercise caution when opening TIFF image files from untrusted sources. Monitor Red Hat advisories for future updates or patches addressing this vulnerability. Customers with Red Hat Technical Account Managers (TAM) can consult them for further guidance.