PT-2026-28086 · Golang.Org/X/Image · Golang.Org/X/Image/Tiff

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-33809

Mitre

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Fix

Related Identifiers

CVE-2026-33809

Affected Products

Golang.Org/X/Image/Tiff

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-33809 · Security Note
• https://go.dev/issue/78267 · Note
• https://pkg.go.dev/vuln/GO-2026-4815 · Note
• https://go.dev/cl/757660 · Note