CVE-2026-33809: Go Images vulnerable to an out-of-memory error via a crafted TIFF file

Executive brief

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Affected products

• Go golang.org/x/image

References

• https://api.github.com/users/ZephrFish
• https://github.com/ZephrFish
• https://api.github.com/users/ZephrFish/gists%7B/gist_id%7D
• https://api.github.com/users/ZephrFish/repos
• https://avatars.githubusercontent.com/u/5783068?v=4
• https://api.github.com/users/ZephrFish/events%7B/privacy%7D