{"id":"EUVD-2026-39551","enisaUuid":"b1350602-38b5-378f-91b9-8570151abf47","description":"The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.","datePublished":"Jun 25, 2026, 7:47:21 PM","dateUpdated":"Jun 26, 2026, 4:07:00 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://go.dev/cl/788422\nhttps://go.dev/issue/79905\nhttps://pkg.go.dev/vuln/GO-2026-5062\n","aliases":"CVE-2026-46602\nGHSA-pwfv-328h-75x9\n","assigner":"Go","epss":0.61,"enisaIdProduct":[{"id":"e0b37e42-a838-3826-9468-4d13d982c241","product":{"name":"golang.org/x/image/tiff","vendor":{"name":"golang.org/x/image"}},"product_version":"0 \u003c0.43.0"}],"enisaIdVendor":[{"id":"3342e52b-4de1-35f4-9117-f47efdbb74cd","vendor":{"name":"golang.org/x/image"}}],"enisaIdVulnerability":[{"id":"b47d650d-1137-383f-8270-d3d6ca4239fb","vulnerability":{"id":"GHSA-pwfv-328h-75x9","description":"The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.","datePublished":"Jun 25, 2026, 9:31:31 PM","dateUpdated":"Jun 26, 2026, 6:33:50 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-46602\nhttps://go.dev/cl/788422\nhttps://go.dev/issue/79905\nhttps://pkg.go.dev/vuln/GO-2026-5062\n","enisa_id":"EUVD-2026-39551\n","aliases":"GHSA-pwfv-328h-75x9\nCVE-2026-46602\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c30f7f58-c657-3456-8c86-e0e0a16d06e5","vulnerability":{"id":"CVE-2026-46602","description":"The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.","datePublished":"Jun 25, 2026, 7:47:21 PM","dateUpdated":"Jun 26, 2026, 4:07:00 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://go.dev/cl/788422\nhttps://go.dev/issue/79905\nhttps://pkg.go.dev/vuln/GO-2026-5062\n","enisa_id":"EUVD-2026-39551\n","assigner":"Go","epss":0.61,"dataProcessed":"Nov 5, 2026, 7:18:42 AM","vulnerabilityProduct":[{"id":"5d301ff0-db35-3fb0-be8a-1eff0db7546f","product":{"name":"golang.org/x/image/tiff","vendor":{"name":"golang.org/x/image"}},"product_version":"0 \u003c0.43.0"}],"vulnerabilityVendor":[{"id":"46185a3c-ab2c-317f-b4b3-d971d23edcf5","vendor":{"name":"golang.org/x/image"}}]}}],"enisaIdAdvisory":[]}