CVE-2026-46602 Details
Description
The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
A vulnerability exists in the TIFF decoder of the Go programming language's image processing package. The issue arises because the decoder does not impose limits on the size of tiles in tiled images. This lack of validation allows malicious or corrupt images with excessively large tiles to be processed, leading to unbounded memory consumption. Such behavior can cause applications to crash or become unresponsive.
This vulnerability has been fixed in Go version 1.21.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://go.dev/cl/788422 | [email protected] | Source CodeVendor |
| https://go.dev/issue/79905 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://pkg.go.dev/vuln/GO-2026-5062 | [email protected] | AdvisoryVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| golang.org/x/image/tiff | < v0.43.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |