TIFF Decoder Panic Due to Out-of-Bounds Strip Offset

Publication date: 2026-06-26

Last updated on: 2026-07-01

Assigner: Go Project

Description

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-26

Last Modified

2026-07-01

Generated

2026-07-17

AI Q&A

2026-06-27

EPSS Evaluated

2026-07-15

NVD

CVE-2026-46604

Affected Vendors & Products

Vendor	Product	Version / Range
golang	tiff	to 0.43.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the TIFF image decoder, where it can cause a panic (unexpected crash) when attempting to decode an invalid TIFF image that contains an out-of-bounds strip offset.

Impact Analysis

The impact of this vulnerability is that an attacker could potentially cause the TIFF decoder to crash by providing a specially crafted invalid image. This could lead to denial of service in applications that rely on this decoder.

Hi! I’m here to help you understand CVE-2026-46604. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70