Is CVE-2026-46599 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46599 being exploited in the wild.

How severe is CVE-2026-46599?

High severity, with a CVSS score of 7.5, published 29 May 2026.

Which products and versions are affected?

golang.org/x/image (Go) < 0.41.0, SEMVER:introduced=0,fixed=0.41.0; tiff (Go) before v0.41.0.

Is there a fix for CVE-2026-46599?

Yes. golang.org/x/image (Go): upgrade to 0.41.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46599 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46599?

Check whether you run golang.org/x/image (Go) or tiff (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46599: Go x/image/tiff resource exhaustion in PackBits decompression

Q: Is there a fix for CVE-2026-46599?

Yes. golang.org/x/image (Go): upgrade to 0.41.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46599 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-46599?

Check whether you run golang.org/x/image (Go) or tiff (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46599 · Severity: high · CVSS 7.5 · Published 2026-05-29

A vulnerability in the Go TIFF image decoding library could allow an attacker to crash an application or cause a denial-of-service. By providing a specially crafted, small image file, an attacker can force the system to consume excessive processing power and memory during decompression. This can lead to service outages or significant performance degradation for any application that processes user-uploaded TIFF images.

Technologies: golang.org/x/image (Go). Vendors: Go.

Quick answers

Is CVE-2026-46599 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46599 being exploited in the wild.
How severe is CVE-2026-46599?: High severity, with a CVSS score of 7.5, published 29 May 2026.
Which products and versions are affected?: golang.org/x/image (Go) < 0.41.0, SEMVER:introduced=0,fixed=0.41.0; tiff (Go) before v0.41.0.
Is there a fix for CVE-2026-46599?: Yes. golang.org/x/image (Go): upgrade to 0.41.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46599 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46599?: Check whether you run golang.org/x/image (Go) or tiff (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/image (Go): upgrade to 0.41.0 or later
```
go get golang.org/x/image@v0.41.0
```

Technical details

A resource exhaustion vulnerability exists in the golang.org/x/image/tiff package due to a lack of size limits on PackBits-compressed data. The 'unpackBits' and 'Decode' functions in the TIFF decoder do not validate the ratio of compressed to decompressed data, allowing a small input file to expand into a massive amount of data in memory. An unauthenticated remote attacker can exploit this by submitting a specially crafted TIFF image to an application using the library, leading to a denial-of-service (DoS) via CPU and memory exhaustion. The issue is addressed in version 0.41.0 by implementing limits on the amount of PackBits-compressed data the decoder will process.

Affected products

Go golang.org/x/image/tiff < 0.41.0

Identifiers

CVE-2026-46599
GHSA-q675-qj96-32m9
GO-2026-5032

Timeline

2026-05-21: disclosed: Issue reported to Go project by Uuganbayar Lkhamsuren
2026-05-29: advisory: NVD published CVE-2026-46599
2026-07-02: patched: GitHub Advisory published and version 0.41.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.