Skip to main content

Go x/image CVE-2026-46604

| EUVDEUVD-2026-39909 HIGH
Out-of-bounds Write (CWE-787)
2026-06-26 Go
Buffer Overflow Memory Corruption Red Hat Suse Golang Org X Image Tiff Golang Org X Image
7.5
CVSS 3.1 · Vendor: Go
Share

Severity by source

Vendor (Go) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Untrusted TIFF input is parsed without auth or interaction (AV:N/AC:L/PR:N/UI:N); a panic crashes the process so A:H, with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (Go).

CVSS VectorVendor: Go

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jun 29, 2026 - 14:25 vuln.today
CVSS changed
Jun 29, 2026 - 14:22 NVD
7.5 (HIGH)
Patch available
Jun 26, 2026 - 22:02 EUVD
CVE Published
Jun 26, 2026 - 20:22 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

AnalysisAI

Denial of service in the Go golang.org/x/image/tiff decoder allows remote attackers to crash any application that parses untrusted TIFF images. A maliciously crafted image with an out-of-bounds strip offset triggers a panic in the decoder, terminating the goroutine or process (CVSS 7.5, availability-only impact). There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), indicating no observed mass exploitation, but the bug is trivially triggerable wherever the library decodes attacker-supplied images.

Technical ContextAI

golang.org/x/image is an extended set of Go image-processing packages maintained by the Go team, supplementing the standard library's image package. The affected component is the tiff sub-package, which decodes TIFF (Tagged Image File Format) files. TIFF stores pixel data in 'strips', and each strip is located via a StripOffsets tag pointing into the file. The flaw is an unvalidated strip offset: when the decoder reads the offset/length values from a crafted file it does not bound-check them against the actual data buffer, so accessing the strip indexes out of bounds and Go's runtime raises a panic. The Tags field labels this a Buffer Overflow; no formal CWE was assigned in the input, but the root cause maps to CWE-125 (Out-of-bounds Read) leading to an unrecovered panic (reachable assertion/uncontrolled crash, CWE-617/CWE-248).

RemediationAI

Vendor-released patch: golang.org/x/image 0.43.0 - upgrade the dependency to 0.43.0 or later (e.g. 'go get golang.org/x/image@v0.43.0' followed by 'go mod tidy' and rebuild), which is the complete fix. Verify transitive usage with 'govulncheck ./...', which will flag reachable calls via GO-2026-5066 (https://pkg.go.dev/vuln/GO-2026-5066); the upstream fix is documented at https://go.dev/cl/788421 and https://go.dev/issue/80122. If you cannot upgrade immediately, the actionable compensating control is to stop feeding untrusted TIFF data to the decoder: reject or strip TIFF uploads at the application boundary (allowlist only formats you must support), or validate/transcode images in an isolated, restartable worker process so a panic crashes only a sandboxed handler rather than the main service. Wrapping the decode call in a recover() can prevent a full process crash but is a fragile stopgap that does not address the underlying out-of-bounds access and may mask other faults, so treat it as temporary and prioritize the version bump.

More in Golang Org X Image Tiff

View all
CVE-2026-46599 HIGH POC
7.5 May 29

Denial-of-service in the Go golang.org/x/image/tiff package (versions before 0.41.0) allows remote attackers to exhaust

CVE-2026-46602 HIGH
7.5 Jun 25

Uncontrolled memory allocation in the Go golang.org/x/image/tiff decoder (versions before 0.43.0) allows a remote attack
CVE-2026-33809 MEDIUM
5.3 Mar 25

Memory exhaustion in TIFF image processing allows unauthenticated remote attackers to trigger allocation of up to 4GiB o

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Package Hub 15 SP7 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-46604 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy