PT-2026-44992 · Go+1 · Golang.Org/X/Image+1

Uuganbayar Lkhamsuren · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-46599

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The TIFF decoder fails to impose a limit on the size of PackBits-compressed data. This allows a maliciously crafted image, even one with small pixel dimensions and encoded size, to force the decoder to process excessive amounts of compressed data, leading to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-46599

GO-2026-5032

Affected Products

Golang.Org/X/Image

Golang.Org/X/Image/Tiff

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-46599 · Security Note
• https://osv.dev/vulnerability/GO-2026-5032 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2060491912071590260 · Twitter Post
• https://go.dev/issue/79577 · Note
• https://go.dev/cl/759960 · Note
• https://pkg.go.dev/vuln/GO-2026-5032 · Note
• https://groups.google.com/g/golang-announce/c/uhYX90BlBvI · Note