CVE-2026-33809

MEDIUM5.3EPSS 0.01%

OOM from malicious IFD offset in golang.org/x/image/tiff

Published: 3/25/2026Modified: 5/15/2026

Description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Affected packages (3)

Debian/golang-golang-x-imagefrom 0
Go/golang.org/x/imagefrom 0, < 0.38.0
Go/golang.org/x/imagefrom 0, < 0.38.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References (6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-33809
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-33809
PATCHhttps://cs.opensource.google/go/x/image
WEBhttps://go.dev/cl/757660
WEBhttps://go.dev/issue/78267
WEBhttps://pkg.go.dev/vuln/GO-2026-4815