CVE-2026-46599

The golang.org/x/image/tiff package contains a vulnerability where the TIFF decoder fails to impose limits on the size of PackBits-compressed data . An attacker can exploit this by providing a maliciously-crafted image with small pixel dimensions and encoded size, forcing the decoder to process a...

CVE-2026-46599 Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image both in terms of pixel width/height and encoded size to make the decoder decode large amounts of compressed data...