CVE-2026-46604: Go TIFF Decoder Denial-of-Service Vulnerability

Technical summary

CVE-2026-46604 is an out-of-bounds memory access vulnerability in golang.org/x/image/tiff (the TIFF decoder in the Go image library). The decoder does not adequately validate strip offset values during image decompression. When an attacker provides a TIFF file with an invalid strip offset that exceeds allocated bounds, the decoder attempts to access memory outside safe ranges, triggering a panic and crashing the application. This falls under CWE-787 (Out-of-bounds Write), though the practical impact is denial of service rather than data corruption. The vulnerability is remotely exploitable with no authentication or user interaction required, making it straightforward to trigger in production environments.

Business impact

Any organization running Go applications that decode TIFF images is exposed to availability risk. This includes web services accepting image uploads, content management systems processing TIFF files, document digitization platforms, and cloud storage services with image preview functionality. An attacker can send a malicious TIFF file to crash the service, disrupting business operations. The impact is limited to availability; no data exfiltration or system compromise is possible. Organizations should assess whether TIFF decoding is critical to their service and prioritize remediation accordingly.

Affected systems

The golang.org/x/image/tiff package is affected. This includes any Go application, library, or service that imports the standard Go image/tiff package or the extended golang.org/x/image/tiff module and processes TIFF files from untrusted sources. No specific version ranges are listed in the source data—verify affected versions against the official Go security advisory and golang.org/x/image repository release notes.

Exploitability

This vulnerability has a CVSS 3.1 score of 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating it is network-accessible, requires low attack complexity, no privileges, no user interaction, and causes high availability impact. The barrier to exploitation is low: an attacker simply needs to craft or obtain a TIFF file with an out-of-bounds strip offset and deliver it to a vulnerable application. No special tools or deep knowledge are required. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but the simplicity of triggering the crash means exploitation could occur quickly if attackers become aware of the issue.

Remediation

Update golang.org/x/image/tiff to a patched version. Consult the official Go security advisory and the golang.org/x/image repository for the exact version that resolves this issue. Additionally, implement input validation at the application layer: reject or sanitize TIFF files from untrusted sources, enforce file size limits, and consider using a sandboxed image processing service if TIFF support is not essential. Monitoring for repeated image decode failures may help detect exploitation attempts.

Patch guidance

Apply the latest security patch from the golang.org/x/image repository. Go developers should run 'go get -u golang.org/x/image' or update their go.mod dependencies to the minimum patched version. Test patched versions thoroughly in a staging environment before production deployment, particularly if your application handles a high volume of image files. Verify the patch version against the official Go security advisory to confirm you are applying the correct fix.

Detection guidance

Monitor application logs for TIFF decoder panics or runtime errors related to strip offset validation. Set alerts on any instance of the decoder crashing or throwing out-of-bounds exceptions. Network-based detection is challenging since a malicious TIFF is valid HTTP traffic; focus on endpoint detection by instrumenting image processing code to log decode failures. If your application uses structured logging, correlate decode errors with the source of the TIFF file (upload IP, user ID, etc.) to identify attack patterns. Consider implementing rate limiting on image upload endpoints to slow denial-of-service attacks.

Why prioritize this

This vulnerability should be prioritized based on your organization's exposure. If your Go application accepts TIFF files from the internet or untrusted users, prioritize patching immediately because exploitation is trivial and the impact (service crash) is direct. If TIFF handling is internal-only or restricted to trusted sources, remediation can be scheduled in the next regular patching cycle. The lack of KEV status and active exploitation does not diminish the urgency for externally-facing services; the vulnerability is recent and straightforward to weaponize.

Risk score, explained

The CVSS 7.5 (HIGH) score reflects the combination of network accessibility, low attack complexity, and high availability impact. The absence of confidentiality and integrity impact (C:N/I:N) prevents a critical rating, but the guaranteed denial of service justifies high severity. For organizations where TIFF decoding is non-critical, risk may be lower; for those where image processing is core functionality, effective risk is higher.

Frequently asked questions