CVE-2026-46602 — Lack of limit on tile sizes in x/image/tiff in golang.org/x/image

CVE-2026-46602

Lack of limit on tile sizes in x/image/tiff in golang.org/x/image PUBLISHED

Description (CNA)

The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.

Affected (CNA)

Vendor / product	Versions
golang.org/x/image / golang.org/x/image/tiff	affected 0 before 0.43.0

CWE

No CWE identifiers supplied.

References

https://go.dev/cl/788422
https://go.dev/issue/79905
https://pkg.go.dev/vuln/GO-2026-5062

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.