{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aneeviadocuprinter_pro/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:neevia:docuprinter_pro:*:*:*:*:*:*:*:*","cpe:2.3:a:libtiff:libtiff:3.5.7:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2025-55891"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["docuPrinter Pro (\u003c= 7.3)","libtiff (3.5.7)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Neevia"],"content_html":"\u003cp\u003eA heap corruption vulnerability (CVE-2025-55891) has been identified in \u003ccode\u003eTIFFCP.EXE\u003c/code\u003e, a command-line utility bundled with Neevia docuPrinter Pro 7.3 and earlier. The vulnerability stems from the use of libtiff version 3.5.7, which contains an unsafe assertion in the LZW decoding logic (\u003ccode\u003etif_lzw.c\u003c/code\u003e). An attacker can trigger a segmentation fault or a \u003ccode\u003eSTATUS_ACCESS_VIOLATION\u003c/code\u003e by supplying a specially crafted TIFF file. This issue affects both the proprietary Windows binary and open-source versions compiled from the affected libtiff code.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation causes the \u003ccode\u003eTIFFCP.EXE\u003c/code\u003e process to crash, resulting in a denial-of-service for the application. No special privileges are required to trigger the memory access violation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory systems for installed instances of Neevia docuPrinter Pro version 7.3 and earlier.\u003c/li\u003e\n\u003cli\u003eApply patches provided by Neevia Technology for docuPrinter Pro as soon as they become available.\u003c/li\u003e\n\u003cli\u003eImplement file-type validation or sandboxed processing for any TIFF images handled by docuPrinter Pro if immediate patching is not possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T05:47:18Z","date_published":"2026-10-28T05:47:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-neevia-docuprinter-pro-heap-corruption/","summary":"A public proof-of-concept exploit exists for CVE-2025-55891, a heap corruption vulnerability in Neevia docuPrinter Pro caused by an outdated libtiff library that triggers a crash during malformed LZW decompression.","title":"Neevia docuPrinter Pro: TIFFCP.EXE heap corruption (CVE-2025-55891)","url":"https://feed.craftedsignal.io/briefs/2026-10-neevia-docuprinter-pro-heap-corruption/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:neevia:docuprinter_pro:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}