CVE-2026-33809 — OOM from malicious IFD offset in golang.org/x/image/tiff

CVE-2026-33809

OOM from malicious IFD offset in golang.org/x/image/tiff PUBLISHED

Description (CNA)

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Affected (CNA)

Vendor / product	Versions
golang.org/x/image / golang.org/x/image/tiff	affected 0 before 0.38.0

CWE

No CWE identifiers supplied.

References

https://go.dev/cl/757660
https://go.dev/issue/78267
https://pkg.go.dev/vuln/GO-2026-4815

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.