En bref
- CVE-2026-46599 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant golang.org/x/image.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.35%, plus élevée que 29.0% des vulnérabilités.
- Correctif : mettre à jour vers 0.41.0 ou plus récent.
Description
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
NVD description
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free