CVE-2026-33809: OOM from malicious IFD offset in golang.org/x/image/tiff
A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33809?
CVE-2026-33809 is categorized as a high-severity vulnerability due to the potential for excessive resource consumption.
How do I fix CVE-2026-33809?
To mitigate CVE-2026-33809, ensure you are using the latest version of golang.org/x/image/tiff which contains the patch for this vulnerability.
What can happen if I open a malicious TIFF file affected by CVE-2026-33809?
Opening a maliciously crafted TIFF file can result in attempting to allocate excessive memory, leading to resource exhaustion or an out-of-memory error.
Which software is affected by CVE-2026-33809?
CVE-2026-33809 specifically affects the golang.org/x/image/tiff package in Go.
Is CVE-2026-33809 exploitable remotely?
CVE-2026-33809 can be exploited if an attacker provides a malicious TIFF file to a vulnerable application that processes images.