CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

Score

CVSS 3.1 7.5 High

Status

Analyzed - security@golang.org

Published

2026-06-26

Last modified

2026-10-25

Weaknesses

CWE-787

Affected products

• Tiff (Golang)
• Golang.orgximagetiff (Golang.orgximage)

References

• https://go.dev/cl/788421
• https://go.dev/issue/80122
• https://pkg.go.dev/vuln/GO-2026-5066