CVE-2026-46599

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/759960
https://go.dev/issue/79577
https://groups.google.com/g/golang-announce/c/uhYX90BlBvI
https://pkg.go.dev/vuln/GO-2026-5032

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-29 20:16

Updated : 2026-07-22 06:10

NVD link : CVE-2026-46599

Mitre link : CVE-2026-46599

CVE.ORG link : CVE-2026-46599

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-46599", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46599", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T14:43:59.743802Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "golang.org/x/image", "product": "golang.org/x/image/tiff", "versions": [{"status": "affected", "version": "0", "lessThan": "0.41.0", "versionType": "semver"}], "packageName": "golang.org/x/image/tiff", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "unpackBits"}, {"name": "Decode"}]}]}], "published": "2026-05-29T20:16:28.280", "references": [{"url": "https://go.dev/cl/759960", "source": "security@golang.org"}, {"url": "https://go.dev/issue/79577", "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/uhYX90BlBvI", "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5032", "source": "security@golang.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data."}, {"lang": "es", "value": "El decodificador TIFF no impone un l\u00edmite en el tama\u00f1o de los datos comprimidos con PackBits. Una imagen creada maliciosamente puede explotar esto para hacer que una imagen peque\u00f1a (tanto en t\u00e9rminos de ancho/alto de p\u00edxeles como de tama\u00f1o codificado) provoque que el decodificador decodifique grandes cantidades de datos comprimidos."}], "lastModified": "2026-07-22T06:10:00.170", "sourceIdentifier": "security@golang.org"}