CVE-2026-46602

The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.

Score

CVSS 3.1 7.5 High

Status

Deferred - security@golang.org

Published

2026-06-25

Last modified

2026-10-25

Affected products

• Golang.orgximagetiff (Golang.orgximage)

References

• https://go.dev/cl/788422
• https://go.dev/issue/79905
• https://pkg.go.dev/vuln/GO-2026-5062