Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-46602

Lack of limit on tile sizes in x/image/tiff in golang.org/x/image

Description

The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

golang.org/x/image golang.org/x/image/tiff

Default version status: unaffected

  • 0 to < 0.43.0affected

References