CVE-2025-61143 libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Discovered in libtiff Affecting Versions up to 4.7.1 Two vulnerabilities have been identified in the libtiff library, affecting versions up to 4.7.1. CVE-2025-61145 involves a double free in tools/tiffcrop.c, while CVE-2025-61143 is related to a NULL pointer dereference in libtiff/tif_open.c. Both vulnerabilities were published on February 23, 2026. 2 sources 41