Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-33809

OOM from malicious IFD offset in golang.org/x/image/tiff

Description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

golang.org/x/image golang.org/x/image/tiff

Default version status: unaffected

  • 0 to < 0.38.0affected

References