Neevia docuPrinter Pro: TIFFCP.EXE heap corruption (CVE-2025-55891)

A heap corruption vulnerability (CVE-2025-55891) has been identified in TIFFCP.EXE, a command-line utility bundled with Neevia docuPrinter Pro 7.3 and earlier. The vulnerability stems from the use of libtiff version 3.5.7, which contains an unsafe assertion in the LZW decoding logic (tif_lzw.c). An attacker can trigger a segmentation fault or a STATUS_ACCESS_VIOLATION by supplying a specially crafted TIFF file. This issue affects both the proprietary Windows binary and open-source versions compiled from the affected libtiff code.

Impact

Successful exploitation causes the TIFFCP.EXE process to crash, resulting in a denial-of-service for the application. No special privileges are required to trigger the memory access violation.

Recommendation

• Inventory systems for installed instances of Neevia docuPrinter Pro version 7.3 and earlier.
• Apply patches provided by Neevia Technology for docuPrinter Pro as soon as they become available.
• Implement file-type validation or sandboxed processing for any TIFF images handled by docuPrinter Pro if immediate patching is not possible.