CVE-2026-33809

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Score

CVSS 3.1 5.3 Medium

Status

Analyzed - security@golang.org

Published

2026-03-25

Last modified

2026-04-06

Weaknesses

CWE-434

Affected products

• Tiff (Golang)
• Golang.orgximagetiff (Golang.orgximage)

References

• https://go.dev/cl/757660
• https://go.dev/issue/78267
• https://pkg.go.dev/vuln/GO-2026-4815