PT-2026-55410 · Go · Golang.Org/X/Image

Publicado 2026-07-02 · Atualizado 2026-07-02

OSV

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

GHSA-Q675-QJ96-32M9

Produtos afetados

Golang.Org/X/Image

Referências · 7

• https://go.dev/issue/79577 · Nota
• https://cs.opensource.google/go/x/image · Nota
• https://go.dev/cl/759960 · Nota
• https://pkg.go.dev/vuln/GO-2026-5032 · Nota
• https://osv.dev/vulnerability/GHSA-q675-qj96-32m9 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-46599 · Nota de Segurança
• https://groups.google.com/g/golang-announce/c/uhYX90BlBvI · Nota