CVE-2026-46604
Description
A flaw was found in the golang.org/x/image/tiff component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted, invalid TIFF image. When the TIFF decoder attempts to process an image with an out-of-bounds strip offset, it can panic, leading to the unavailability of the affected system.
Statement
A flaw was found in the golang.org/x/image/tiff package. The TIFF decoder does not validate strip offsets read from a TIFF Image File Directory (IFD) before dereferencing them. Processing a specially crafted, invalid TIFF image with an out-of-bounds strip offset triggers a runtime panic, causing a denial of service in any application that decodes attacker-supplied TIFF images, such as thumbnail generators, document processors, or image upload handlers. Exploitation requires the application to decode a malicious TIFF file supplied by the attacker (CVSS UI:R); there is no impact to confidentiality or integrity, only availability.
Mitigation
There is no complete inline mitigation for this issue; the fix requires upgrading golang.org/x/image to version 0.43.0 or later, which validates the strip offset before use. Where an immediate upgrade is not possible, exposure can be reduced by not decoding untrusted or externally supplied TIFF images, or by isolating TIFF decoding in a sandboxed, restartable worker process so a panic does not crash the primary service.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
