Golang Org X Image
Monthly
Memory exhaustion via crafted VP8L images affects golang.org/x/image/vp8l in all versions before 0.45.0, enabling remote unauthenticated attackers to crash Go applications that process untrusted image content through this library. The VP8L decoder fails to bound heap allocation when decoding images that declare many unused Huffman tree groups, turning a parsing decision into unconstrained memory growth. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial network attack vector and zero-privilege requirement make this a practical DoS risk for any internet-facing service accepting image uploads.
Denial of service in the Go golang.org/x/image/tiff decoder allows remote attackers to crash any application that parses untrusted TIFF images. A maliciously crafted image with an out-of-bounds strip offset triggers a panic in the decoder, terminating the goroutine or process (CVSS 7.5, availability-only impact). There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), indicating no observed mass exploitation, but the bug is trivially triggerable wherever the library decodes attacker-supplied images.
Uncontrolled memory allocation in the Go golang.org/x/image/tiff decoder (versions before 0.43.0) allows a remote attacker to crash applications by supplying a crafted TIFF image whose tiled-image structure declares an enormous tile size, which the decoder attempts to allocate without any bound. The result is denial of service through memory exhaustion (CVSS 7.5, A:H only). There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), but the flaw is trivially triggerable wherever untrusted TIFF input is decoded.
Denial of service in the golang.org/x/image/webp decoder (versions before 0.43.0) allows remote attackers to crash any Go application that decodes attacker-supplied WebP images. A malformed VP8 chunk whose declared dimensions differ from the canvas size triggers an unrecovered panic, aborting the goroutine or process. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and SSVC lists exploitation as none, but the flaw is trivially reachable and automatable wherever untrusted images are processed.
Denial-of-service in the Go golang.org/x/image/tiff package (versions before 0.41.0) allows remote attackers to exhaust memory or CPU by submitting a small, maliciously-crafted TIFF image whose PackBits-compressed stream decodes to disproportionately large output. Any Go service that parses untrusted TIFF input via this library is exposed; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 5th percentile).
Denial of service in Go's x/image/webp library allows remote attackers to crash 32-bit applications by sending specially crafted WEBP images with invalid large size values, triggering runtime panic. Vendor patch released (version 0.39.0) with low EPSS score (0.02%) indicating minimal observed exploitation activity. Despite network vector and no authentication requirements (CVSS AV:N/PR:N), exploitation is platform-specific to 32-bit architectures only.
Panic-induced denial of service in the golang.org/x/image/bmp decoder allows remote unauthenticated attackers to crash any Go application that processes untrusted BMP files. When a paletted BMP containing an out-of-range palette index is decoded, the image package accesses invalid memory and triggers a Go runtime panic, terminating the affected goroutine or process. No public exploit exists at time of analysis, but the attack is automatable per SSVC and requires no privileges or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), making any internet-exposed BMP processing endpoint an accessible target.
Excessive memory allocation in the golang.org/x/image/font/sfnt SFNT font parser allows denial of service when processing a malicious font file. All versions of the package prior to 0.39.0 are affected, as confirmed by the Go vulnerability database (GO-2026-4962) and EUVD-2026-24245. An attacker who can supply a crafted font file to any Go application using this library can cause the application to exhaust available memory and crash. No public exploit has been identified and SSVC confirms no active exploitation at time of analysis.
Memory exhaustion in TIFF image processing allows unauthenticated remote attackers to trigger allocation of up to 4GiB of memory by submitting malicious image files, resulting in denial of service through resource depletion or application crashes. Affected systems lack available patches, leaving deployed instances vulnerable to this attack vector requiring only network access and no user interaction.
Memory exhaustion via crafted VP8L images affects golang.org/x/image/vp8l in all versions before 0.45.0, enabling remote unauthenticated attackers to crash Go applications that process untrusted image content through this library. The VP8L decoder fails to bound heap allocation when decoding images that declare many unused Huffman tree groups, turning a parsing decision into unconstrained memory growth. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial network attack vector and zero-privilege requirement make this a practical DoS risk for any internet-facing service accepting image uploads.
Denial of service in the Go golang.org/x/image/tiff decoder allows remote attackers to crash any application that parses untrusted TIFF images. A maliciously crafted image with an out-of-bounds strip offset triggers a panic in the decoder, terminating the goroutine or process (CVSS 7.5, availability-only impact). There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), indicating no observed mass exploitation, but the bug is trivially triggerable wherever the library decodes attacker-supplied images.
Uncontrolled memory allocation in the Go golang.org/x/image/tiff decoder (versions before 0.43.0) allows a remote attacker to crash applications by supplying a crafted TIFF image whose tiled-image structure declares an enormous tile size, which the decoder attempts to allocate without any bound. The result is denial of service through memory exhaustion (CVSS 7.5, A:H only). There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), but the flaw is trivially triggerable wherever untrusted TIFF input is decoded.
Denial of service in the golang.org/x/image/webp decoder (versions before 0.43.0) allows remote attackers to crash any Go application that decodes attacker-supplied WebP images. A malformed VP8 chunk whose declared dimensions differ from the canvas size triggers an unrecovered panic, aborting the goroutine or process. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and SSVC lists exploitation as none, but the flaw is trivially reachable and automatable wherever untrusted images are processed.
Denial-of-service in the Go golang.org/x/image/tiff package (versions before 0.41.0) allows remote attackers to exhaust memory or CPU by submitting a small, maliciously-crafted TIFF image whose PackBits-compressed stream decodes to disproportionately large output. Any Go service that parses untrusted TIFF input via this library is exposed; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 5th percentile).
Denial of service in Go's x/image/webp library allows remote attackers to crash 32-bit applications by sending specially crafted WEBP images with invalid large size values, triggering runtime panic. Vendor patch released (version 0.39.0) with low EPSS score (0.02%) indicating minimal observed exploitation activity. Despite network vector and no authentication requirements (CVSS AV:N/PR:N), exploitation is platform-specific to 32-bit architectures only.
Panic-induced denial of service in the golang.org/x/image/bmp decoder allows remote unauthenticated attackers to crash any Go application that processes untrusted BMP files. When a paletted BMP containing an out-of-range palette index is decoded, the image package accesses invalid memory and triggers a Go runtime panic, terminating the affected goroutine or process. No public exploit exists at time of analysis, but the attack is automatable per SSVC and requires no privileges or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), making any internet-exposed BMP processing endpoint an accessible target.
Excessive memory allocation in the golang.org/x/image/font/sfnt SFNT font parser allows denial of service when processing a malicious font file. All versions of the package prior to 0.39.0 are affected, as confirmed by the Go vulnerability database (GO-2026-4962) and EUVD-2026-24245. An attacker who can supply a crafted font file to any Go application using this library can cause the application to exhaust available memory and crash. No public exploit has been identified and SSVC confirms no active exploitation at time of analysis.
Memory exhaustion in TIFF image processing allows unauthenticated remote attackers to trigger allocation of up to 4GiB of memory by submitting malicious image files, resulting in denial of service through resource depletion or application crashes. Affected systems lack available patches, leaving deployed instances vulnerable to this attack vector requiring only network access and no user interaction.