Golang Org X Image Tiff CVE-2026-33809

The vulnerability resides in Go's standard image/tiff decoding library, specifically in golang.org/x/image/tiff (referenced via CPE cpe:2.3:a:golang.org/x/image:golang.org/x/image/tiff:*:*:*:*:*:*:*:*). The root cause is insufficient validation of TIFF file headers and metadata before memory allocation, allowing an attacker to craft a specially formatted TIFF file that specifies impossibly large image dimensions or allocation parameters. This falls under the category of resource exhaustion vulnerabilities, related to improper input validation and lack of bounds checking. When the decoder attempts to allocate buffers for image data based on untrusted file metadata, it can request up to 4 GiB of memory without adequate sanity checks, leading to either memory exhaustion on systems with constrained resources or triggering the operating system's out-of-memory killer.