EUVD-2026-39551
GHSA-pwfv-328h-75x9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Untrusted image reaches the decoder remotely with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is memory-exhaustion DoS only, so C:N/I:N/A:H.
Primary rating from Vendor (Go).
CVSS VectorVendor: Go
Lifecycle Timeline
4DescriptionCVE.org
The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
AnalysisAI
Uncontrolled memory allocation in the Go golang.org/x/image/tiff decoder (versions before 0.43.0) allows a remote attacker to crash applications by supplying a crafted TIFF image whose tiled-image structure declares an enormous tile size, which the decoder attempts to allocate without any bound. The result is denial of service through memory exhaustion (CVSS 7.5, A:H only). There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), but the flaw is trivially triggerable wherever untrusted TIFF input is decoded.
Technical ContextAI
The affected component is golang.org/x/image/tiff, the supplementary (non-standard-library) TIFF codec maintained by the Go team for the x/image module. TIFF supports two internal data layouts: strip-based and tile-based. For tiled images, the tile dimensions are read directly from tags in the file header, and the vulnerable decoder allocated buffers sized from those attacker-controlled values without validating them against the actual image geometry or any sane upper bound. This is a classic CWE-770 (Allocation of Resources Without Limits or Throttling) / CWE-400 (Uncontrolled Resource Consumption) pattern; the input CWE field is N/A, so this classification is inferred from the description. Any Go program importing this package to decode user-supplied TIFF files (image galleries, thumbnailers, document/OCR pipelines, upload processors) inherits the exposure.
RemediationAI
Vendor-released patch: golang.org/x/image 0.43.0 - upgrade the dependency to 0.43.0 or later (run 'go get golang.org/x/image@v0.43.0' and rebuild), then confirm no transitive dependency pins an older copy using 'go mod graph' or 'govulncheck', which will report GO-2026-5062. The upstream fix is tracked at https://go.dev/issue/79905 with the change at https://go.dev/cl/788422. If you cannot upgrade immediately, apply compensating controls: reject or pre-validate TIFF uploads before they reach the decoder by enforcing a strict maximum file size and, where feasible, rejecting tiled TIFFs (trade-off: legitimate large or tiled TIFFs will be refused); run TIFF decoding in a memory-capped sandbox or worker with an OS-level memory cgroup limit so exhaustion kills only the worker rather than the host (trade-off: added latency and operational complexity); and rate-limit the image-processing endpoint to blunt automated abuse.
More in Golang Org X Image Tiff
View allDenial-of-service in the Go golang.org/x/image/tiff package (versions before 0.41.0) allows remote attackers to exhaust
Denial of service in the Go golang.org/x/image/tiff decoder allows remote attackers to crash any application that parses
Memory exhaustion in TIFF image processing allows unauthenticated remote attackers to trigger allocation of up to 4GiB o
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today