Excessive Data Processing in TIFF Decoder by GoLang

CVE-2026-46599

What is CVE-2026-46599?

The TIFF decoder in GoLang lacks proper size limitations for PackBits-compressed data, allowing a specially crafted TIFF image to exploit this weakness. Even small images, in terms of dimensions and encoded size, can lead to the decoder processing large volumes of compressed data, potentially causing performance issues or denial of service. Maintaining robust input validation and size checks is crucial to protect against this vulnerability.

References