CVE-2026-33809

OOM from malicious IFD offset in golang.org/x/image/tiff

Medium · published March 25, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00403 · 33.4th percentile
Published
2026-03-25T18:24Z
EPSS history
Timeline
  • 25 MAR 18:24Z
    OOM from malicious IFD offset in golang.org/x/image/tiff
    cvelistv5