PatchSiren cyber security CVE debrief
CVE-2026-46599 golang.org/x/image CVE debrief
A vulnerability in the Go standard library's TIFF decoder allows maliciously-crafted images to trigger excessive memory consumption. The PackBits decompression routine lacks bounds checking on compressed data size, enabling a small input image to expand into arbitrarily large decompressed output. This represents a denial-of-service vector through resource exhaustion. The issue was addressed in Go's security release cycle with a fix that imposes appropriate limits on decompressed data size.
- Vendor
- golang.org/x/image
- Product
- golang.org/x/image/tiff
- CVSS
- Unknown
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-29
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-29
- Advisory updated
- 2026-05-29
Who should care
Organizations running Go applications that process TIFF images from untrusted sources, including web services, document processing pipelines, image conversion tools, and security scanning products.
Technical summary
The Go standard library's image/tiff package contains a vulnerability in its PackBits decompression implementation. PackBits is a run-length encoding compression scheme used in TIFF images. The decoder fails to validate or limit the size of decompressed data relative to the input, allowing an attacker to craft a small TIFF image that expands to consume excessive memory during decoding. This is a classic 'decompression bomb' or 'zip bomb' style attack adapted to the TIFF format. The vulnerability affects applications that process untrusted TIFF images, potentially causing denial of service through memory exhaustion or out-of-memory crashes.
Defensive priority
high
Recommended defensive actions
- Upgrade Go to the latest patched version as indicated in the Go security announcement
- Review applications processing untrusted TIFF images for resource exhaustion risks
- Implement input validation and resource limits for image processing pipelines
- Monitor Go vulnerability database at pkg.go.dev/vuln for additional guidance
Evidence notes
Vulnerability confirmed through official Go security channels including golang-announce mailing list and Go vulnerability database entry GO-2026-5032. Fix implemented in Go change list 759960.
Official resources
2026-05-29