Go Images vulnerable to an out-of-memory error via a crafted TIFF file

MEDIO 5.3CVE-2026-33809 · GHSA-44p7-9xx4-hf2g · GO-2026-4815 · Published 25/03/2026 · updated 17/06/2026

En resumen

CVE-2026-33809 es una vulnerabilidad MEDIO (CVSS 5.3) que afecta a golang.org/x/image, tiff (golang).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.33%, mayor que el 26.8% de las vulnerabilidades.
Solución: actualizar a 0.38.0 o posterior.

Package	Affected versions	Patched versions
golang.org/x/image Go	`< 0.38.0`	`0.38.0`
tiff golang	`< 0.38.0`	`0.38.0`

Description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

NVD description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

References

nvd.nist.gov/vuln/detail/CVE-2026-33809 · ADVISORY
cs.opensource.google/go/x/image · PACKAGE
go.dev/cl/757660 · WEB
go.dev/issue/78267 · WEB
pkg.go.dev/vuln/GO-2026-4815 · WEB

Más vulnerabilidades de golang.org/x/image

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

golang.org/x/image

< 0.38.0

0.38.0

tiff

golang

< 0.38.0

0.38.0

Description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

NVD description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Más vulnerabilidades de golang.org/x/image

Ver todo →