CVE Feed

    Dashboard / CVE / CVE-2026-33809

    CVE-2026-33809

    A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

    Published:Mar 25, 2026
    Last Modified:Apr 22, 2026
    EPS:Mar 25, 2026
    EPSS Score:0.00012
    CVSS Score:5.3

    Affected Products

    Vendor
    Golang
    Product
    Image
    Vendor
    Golang
    Product
    Tiff

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Related CVEs

    CVE-2026-46603 (CVSS 7.5) — VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted …
    CVE-2026-46604 (CVSS 7.5) — The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.…
    CVE-2026-46602 (CVSS 7.5) — The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt …
    CVE-2026-46601 (CVSS 7.5) — The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.…
    CVE-2026-46599 (CVSS 7.5) — The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image c…
    CVE-2026-42500 (CVSS 5.3) — Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in th…
    CVE-2026-33812 (CVSS 6.1) — Parsing a malicious font file can cause excessive memory allocation.…
    CVE-2026-33813 (CVSS 7.5) — Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.…
    CVE-2023-29408 (CVSS 6.5) — The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can e…
    CVE-2023-29407 (CVSS 6.5) — A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High