terribledactyl/cve-2025-55891Proof-of-concept for CVE-2025-55891: heap corruption in TIFFCP.EXE via malformed TIFF file, triggering segmentation fault during LZW decompression in libtiff 3.5.7.
A heap corruption vulnerability exists in TIFFCP.EXE, a command-line utility bundled with Neevia docuPrinter Pro, due to the use of an outdated and vulnerable version of libtiff (v3.5.7). By supplying a specially crafted TIFF file, an attacker can trigger a segmentation fault during LZW decompression.
This issue has been reproduced on both Linux (via the open-source tiffcp compiled from libtiff 3.5.7) and on Windows using the proprietary TIFFCP.EXE distributed with docuPrinter Pro. On Windows, the crash results in a STATUS_ACCESS_VIOLATION and occurs without requiring any special privileges.
TIFFCP.EXE as distributed in Neevia docuPrinter Pro 7.3 and earlierThe vulnerability is triggered in the LZW decoding logic within tif_lzw.c at the following assertion:
assert(&sp->dec_codetab[0] <= free_entp && free_entp < &sp->dec_codetab[CSIZE]);
For authorized use only. This research was performed independently of any employer. Protected under Section 1201 exemption of the DMCA for good-faith security research.