PT-2026-55410 · Go · Golang.Org/X/Image

Published 2026-07-02 · Updated 2026-07-02

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

GHSA-Q675-QJ96-32M9

Affected Products

Golang.Org/X/Image

References · 7

• https://osv.dev/vulnerability/GHSA-q675-qj96-32m9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46599 · Security Note
• https://go.dev/issue/79577 · Note
• https://cs.opensource.google/go/x/image · Note
• https://go.dev/cl/759960 · Note
• https://pkg.go.dev/vuln/GO-2026-5032 · Note
• https://groups.google.com/g/golang-announce/c/uhYX90BlBvI · Note