CVE-2022-41727: Denial of service via crafted TIFF image in golang.org/x/image/tiff
An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41727?
The severity of CVE-2022-41727 is medium, with a severity value of 5.5.
How can an attacker exploit CVE-2022-41727?
An attacker can exploit CVE-2022-41727 by crafting a malformed TIFF image that consumes a significant amount of memory when passed to DecodeConfig, leading to a denial of service.
Which software packages are affected by CVE-2022-41727?
The following software packages are affected by CVE-2022-41727: golang.org/x/image (version up to 0.5.0), Golang Image, and Golang Tiff.
Is there a fix available for CVE-2022-41727?
Yes, a fix for CVE-2022-41727 is available in version 0.5.0 of golang.org/x/image.
Are there any references for CVE-2022-41727?
Yes, the following references provide more information on CVE-2022-41727: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-41727), [Go.dev CL](https://go.dev/cl/468195), [Go.dev issue](https://go.dev/issue/58003).