CVE-2026-46602: Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
Published Jun 25, 2026
·Updated
The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
Affected Software
1 affected component
golang.org/x/image/tiff=
Event History
Jun 25, 2026
CVE Published
via MITRE·07:47 PM
Data Sourced
via MITRE·07:47 PM
DescriptionWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2026-46602?
CVE-2026-46602 has a severity rating of high with a CVSS score of 7.5.
2
What kind of vulnerability is CVE-2026-46602?
CVE-2026-46602 is a vulnerability that results from a lack of limits on tile sizes in the TIFF decoder of golang.org/x/image.
3
How does CVE-2026-46602 affect applications?
CVE-2026-46602 can cause unbounded memory consumption due to the processing of malicious or corrupt images with very large tiles.
4
How do I fix CVE-2026-46602?
To fix CVE-2026-46602, ensure that you apply patches from golang.org/x/image that enforce limits on tile sizes in TIFF images.
5
When was CVE-2026-46602 published?
CVE-2026-46602 was published on June 25, 2026.