Unbounded Memory Consumption in Tiled Image Processing for Go Products

CVE-2026-46602

What is CVE-2026-46602?

The TIFF decoder within certain Go products lacks a restriction on the tile size of tiled images. This oversight allows an attacker to exploit the system by uploading a specially crafted image containing exceptionally large tiles, potentially leading to unbounded memory consumption. Such conditions may result in degraded performance or system crashes, as memory resources are overwhelmed. This vulnerability highlights the necessity for implementing proper size limitations to safeguard applications from malicious activities.

References