CVE-2025-61145

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-415

Affected software

No affected versions have been published.

Timeline

Published
Feb 23, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-611464.0saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c.CVE-2025-611476.2strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decoder_context::compute_framedrop_table(CVE-2025-611486.5An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to accessCVE-2025-61158.8A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this issue is the function form_macfilter. The CVE-2025-611526.5python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature verification. A maliCVE-2025-611546.5Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a crafted DWG file to cause a Denial of ServiCVE-2025-611555.5The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL hanCVE-2025-611567.8Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privileges and execute arbCVE-2025-61169.8A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been classified as critical. This affects an unknown part oCVE-2025-611618.4DLL hijacking vulnerability in Evope Collector 1.1.6.9.0 and related components load the wtsapi32.dll library from an uncontrolled search paCVE-2025-611627.5Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/intCVE-2025-611639.8Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the serv
CVE-2025-61145: Medium severity, CVSS 5.0 | Vulnix