CVE-2025-8534

A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used."

• CWE-404
• CWE-476

• http://www.libtiff.org/Product
• https://drive.google.com/file/d/15JPA3kLYiYD-nRNJ8y8HmnYjhv9NE7k6/view?usp=drive_linkExploit
• https://gitlab.com/libtiff/libtiff/-/commit/6ba36f159fd396ad11bf6b7874554197736ecc8bPatch
• https://gitlab.com/libtiff/libtiff/-/issues/718Exploit, Issue Tracking, Vendor Advisory
• https://gitlab.com/libtiff/libtiff/-/merge_requests/746Product
• https://vuldb.com/?ctiid.318664Permissions Required, VDB Entry
• https://vuldb.com/?id.318664Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.617831Third Party Advisory, VDB Entry
• https://gitlab.com/libtiff/libtiff/-/issues/718Exploit, Issue Tracking, Vendor Advisory
• https://vuldb.com/?submit.617831Third Party Advisory, VDB Entry

Published

Aug 5, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-8528A vulnerability classified as problematic has been found in …5.9
• CVE-2025-8529A vulnerability classified as critical was found in cloudfav…6.3
• CVE-2025-8530A vulnerability, which was classified as problematic, has be…7.5
• CVE-2025-8531Improper Handling of Length Parameter Inconsistency vulnerab…6.8
• CVE-2025-8532Authorization Bypass Through User-Controlled Key, Improper A…6.4
• CVE-2025-8533A vulnerability was identified in the XPC services of Fantas…6.9
• CVE-2025-8535A vulnerability, which was classified as problematic, has be…9
• CVE-2025-8536A SQL injection vulnerability has been identified in DobryCM…9.3
• CVE-2025-8537A vulnerability, which was classified as problematic, was fo…5.9
• CVE-2025-8538A vulnerability has been found in Portabilis i-Educar 2.10 a…4.8
• CVE-2025-8539A vulnerability was found in Portabilis i-Educar 2.10 and cl…4.8
• CVE-2025-8540A vulnerability was found in Portabilis i-Educar 2.10. It ha…4.8