CVE-2026-46604 The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset

Description

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

Affected products and versions

Product	Affected versions	Fixed in
golang.org/x/image/tiff 0.43	earliest → < 0.43.0	0.43.0

Other CVEs of golang.org/x/image/tiff

The 8 CVEs of golang.org/x/image/tiff →

CVE-2026-46602 The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image… 7.5 High CVE-2026-46599 The TIFF decoder does not place a limit on the size of PackBits-compressed data 7.5 High CVE-2026-33809 A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either… 5.3 Medium CVE-2024-24792 Parsing a corrupt or malicious image with invalid color indices can cause a panic 7.5 High