{"id":"CVE-2026-46599","sourceIdentifier":"security@golang.org","published":"2026-05-29T20:16:28.280","lastModified":"2026-07-22T06:10:00.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data."},{"lang":"es","value":"El decodificador TIFF no impone un límite en el tamaño de los datos comprimidos con PackBits. Una imagen creada maliciosamente puede explotar esto para hacer que una imagen pequeña (tanto en términos de ancho/alto de píxeles como de tamaño codificado) provoque que el decodificador decodifique grandes cantidades de datos comprimidos."}],"affected":[{"source":"security@golang.org","affectedData":[{"vendor":"golang.org/x/image","product":"golang.org/x/image/tiff","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"golang.org/x/image/tiff","programRoutines":[{"name":"unpackBits"},{"name":"Decode"}],"versions":[{"version":"0","lessThan":"0.41.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-01T14:43:59.743802Z","id":"CVE-2026-46599","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://go.dev/cl/759960","source":"security@golang.org"},{"url":"https://go.dev/issue/79577","source":"security@golang.org"},{"url":"https://groups.google.com/g/golang-announce/c/uhYX90BlBvI","source":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2026-5032","source":"security@golang.org"}]}