CVE-2026-46599 — Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel widt…
Published: 2026-05-29 · CVSS: 7.5 · CVSS 3.1
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7