Executive brief
A vulnerability exists in the Go programming language's TIFF image processing library. An attacker can provide a specially crafted, invalid TIFF image that causes the application to crash (panic) when it attempts to decode the file. This can lead to a denial-of-service, where the affected service becomes unavailable to users.
Technical details
A denial-of-service vulnerability exists in the golang.org/x/image/tiff package due to improper validation of strip offsets during TIFF image decoding. When the `Decode` function encounters an invalid image containing an out-of-bounds strip offset, it triggers a runtime panic rather than returning an error. This can be exploited by a remote, unauthenticated attacker who provides a malicious TIFF file to an application using this library. The issue is resolved in version v0.43.0 of the golang.org/x/image module.
Affected products
- Go Project golang.org/x/image/tiff before v0.43.0
Timeline
- 2026-06-23: disclosed: Issue reported to Go project
- 2026-06-26: advisory: CVE-2026-46604 published
- 2026-06-26: patched: Fix released in v0.43.0