{"id":"EUVD-2026-39909","revision":"72775f51ab0840c8962e49965a8583d1","records":[{"revision":"72775f51ab0840c8962e49965a8583d1","observedAt":"2026-11-07T10:38:54.355+00:00","statement":{"source":"euvd","id":"EUVD-2026-39909","aliases":["CVE-2026-46604"],"title":"The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.","description":"The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://go.dev/cl/788421","https://go.dev/issue/80122","https://pkg.go.dev/vuln/GO-2026-5066"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39909","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 26, 2026, 8:22:46 PM","dateUpdated":"Jun 29, 2026, 1:20:23 PM"},"relatedAdvisories":[{"id":"RHSA-2026:68515","title":"Red Hat Security Advisory: Multicluster Global Hub 1.8.2 security update","vulnerabilityIds":["CVE-2026-17106","CVE-2026-33818","CVE-2026-41178","CVE-2026-42502","CVE-2026-46604","CVE-2026-48586","CVE-2026-50151","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-71235","CVE-2026-71576","CVE-2026-71577","CVE-2026-75762","CVE-2026-77849","CVE-2026-79921","CVE-2026-80220","CVE-2026-80221"]},{"id":"RHSA-2026:66521","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.6.1","vulnerabilityIds":["CVE-2026-15792","CVE-2026-17106","CVE-2026-18140","CVE-2026-29181","CVE-2026-33818","CVE-2026-35469","CVE-2026-39828","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39835","CVE-2026-41178","CVE-2026-42508","CVE-2026-46595","CVE-2026-46597","CVE-2026-46604","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-75593"]},{"id":"RHSA-2026:73038","title":"Red Hat Security Advisory: Multicluster Global Hub 1.8.2 security update","vulnerabilityIds":["CVE-2026-17106","CVE-2026-33818","CVE-2026-41178","CVE-2026-42502","CVE-2026-46604","CVE-2026-48586","CVE-2026-50151","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-71235","CVE-2026-71576","CVE-2026-71577","CVE-2026-75762","CVE-2026-77849","CVE-2026-79921","CVE-2026-80220","CVE-2026-80221"]},{"id":"RHSA-2026:73419","title":"Red Hat Security Advisory: Multicluster Global Hub 1.6.6 security update","vulnerabilityIds":["CVE-2026-32282","CVE-2026-33818","CVE-2026-34040","CVE-2026-41178","CVE-2026-42502","CVE-2026-46604","CVE-2026-48586","CVE-2026-50151","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-66792","CVE-2026-71235","CVE-2026-71576","CVE-2026-71577","CVE-2026-73500","CVE-2026-75762","CVE-2026-77849","CVE-2026-80220","CVE-2026-80221"]},{"id":"openSUSE-SU-2026:21599-1","title":"Security update for kitty","vulnerabilityIds":["CVE-2026-33633","CVE-2026-33642","CVE-2026-42850","CVE-2026-42851","CVE-2026-46604","CVE-2026-54057"]},{"id":"RHSA-2026:67516","title":"Red Hat Security Advisory: Multicluster Global Hub 1.4.9 security update","vulnerabilityIds":["CVE-2026-32282","CVE-2026-33818","CVE-2026-34040","CVE-2026-41178","CVE-2026-42502","CVE-2026-46604","CVE-2026-48586","CVE-2026-50151","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-66792","CVE-2026-71235","CVE-2026-71576","CVE-2026-71577","CVE-2026-73500","CVE-2026-75762","CVE-2026-77849","CVE-2026-80220","CVE-2026-80221"]},{"id":"openSUSE-SU-2026:11155-1","title":"kbfs-6.6.3-2.1 on GA media","vulnerabilityIds":["CVE-2026-46604"]},{"id":"RHSA-2026:71597","title":"Red Hat Security Advisory: Multicluster Global Hub 1.5.8 security update","vulnerabilityIds":["CVE-2026-32282","CVE-2026-33818","CVE-2026-34040","CVE-2026-41178","CVE-2026-42502","CVE-2026-46604","CVE-2026-48586","CVE-2026-50151","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-66792","CVE-2026-71235","CVE-2026-71576","CVE-2026-71577","CVE-2026-73500","CVE-2026-75762","CVE-2026-77849","CVE-2026-80220","CVE-2026-80221"]},{"id":"RHSA-2026:67842","title":"Red Hat Security Advisory: Multicluster Global Hub 1.7.3 security update","vulnerabilityIds":["CVE-2026-32282","CVE-2026-33815","CVE-2026-33818","CVE-2026-34040","CVE-2026-46604","CVE-2026-48586","CVE-2026-50151","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-71235","CVE-2026-71576","CVE-2026-71577","CVE-2026-75762","CVE-2026-77849","CVE-2026-79921","CVE-2026-80220","CVE-2026-80221"]},{"id":"RHSA-2026:70870","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.5.3","vulnerabilityIds":["CVE-2026-18140","CVE-2026-25681","CVE-2026-27136","CVE-2026-29181","CVE-2026-33818","CVE-2026-35469","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-41178","CVE-2026-42151","CVE-2026-42154","CVE-2026-42502","CVE-2026-42508","CVE-2026-46595","CVE-2026-46597","CVE-2026-46600","CVE-2026-46604","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862"]},{"id":"openSUSE-SU-2026:11176-1","title":"kitty-0.47.4-2.1 on GA media","vulnerabilityIds":["CVE-2026-46604"]},{"id":"openSUSE-SU-2026:21230-1","title":"Security update for keybase-client","vulnerabilityIds":["CVE-2026-46604"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-39909","identifiers":["EUVD-2026-39909","CVE-2026-46604"]},"retained":false,"historicalAffected":[]}],"coverage":[]}