CVE-2025-8534: libtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference
A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PSLvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFERSTRILELOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used."
Other sources
libtiff tiff2ps tiff2ps.c PSLvl2page null pointer dereference
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libtiffto a version that resolves this vulnerability.Patch 6ba36f159fd396ad11bf6b7874554197736ecc8b
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8534?
CVE-2025-8534 is classified as a problematic vulnerability due to its impact on local host operations.
How do I fix CVE-2025-8534?
To fix CVE-2025-8534, it's recommended to update to the latest version of libtiff that addresses this vulnerability.
What component is affected by CVE-2025-8534?
CVE-2025-8534 affects the tiff2ps component of libtiff, specifically the function PS_Lvl2page in the file tools/tiff2ps.c.
What type of vulnerability is CVE-2025-8534?
CVE-2025-8534 is a null pointer dereference vulnerability, which can lead to application crashes or unexpected behavior.
Can CVE-2025-8534 be exploited remotely?
CVE-2025-8534 requires local access for exploitation, making it less of a threat in remote attack scenarios.