Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
cve-program · CVE-2026-46599
PublishedThe TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
Read the publisher's advisoryeuvd · EUVD-2026-33432
PublishedThe TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
Read the publisher's advisorynvd · CVE-2026-46599
PublishedThe TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
Read the publisher's advisoryosv · GHSA-q675-qj96-32m9
PublishedThe TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
Read the publisher's advisoryosv · GO-2026-5032
PublishedThe TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-46599 · CVE overview and exploitation status
cve-program · CVE-2026-46599
- https://go.dev/issue/79577
- https://go.dev/cl/759960
- https://groups.google.com/g/golang-announce/c/uhYX90BlBvI
- https://pkg.go.dev/vuln/GO-2026-5032
euvd · EUVD-2026-33432
- https://go.dev/issue/79577
- https://go.dev/cl/759960
- https://groups.google.com/g/golang-announce/c/uhYX90BlBvI
- https://pkg.go.dev/vuln/GO-2026-5032
nvd · CVE-2026-46599
- https://go.dev/cl/759960
- https://go.dev/issue/79577
- https://groups.google.com/g/golang-announce/c/uhYX90BlBvI
- https://pkg.go.dev/vuln/GO-2026-5032
osv · GHSA-q675-qj96-32m9
- https://nvd.nist.gov/vuln/detail/CVE-2026-46599
- https://cs.opensource.google/go/x/image
- https://go.dev/cl/759960
- https://go.dev/issue/79577
- https://groups.google.com/g/golang-announce/c/uhYX90BlBvI
- https://pkg.go.dev/vuln/GO-2026-5032
osv · GO-2026-5032
Related changes
Linked by CVE identifierNo related changes are available here.