{"schema_version":"1.3.1","id":"GO-2026-4815","modified":"2026-04-06T20:49:01Z","published":"2026-03-25T18:02:02Z","aliases":["CVE-2026-33809","GHSA-44p7-9xx4-hf2g"],"summary":"OOM from malicious IFD offset in golang.org/x/image/tiff","details":"A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.","affected":[{"package":{"name":"golang.org/x/image","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.38.0"}]}],"ecosystem_specific":{"imports":[{"path":"golang.org/x/image/tiff","symbols":["Decode","DecodeConfig","buffer.ReadAt","buffer.Slice","buffer.fill"]}]}}],"references":[{"type":"FIX","url":"https://go.dev/cl/757660"},{"type":"REPORT","url":"https://go.dev/issue/78267"}],"credits":[{"name":"Andy Gill, ZephrSec Ltd"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-4815","review_status":"REVIEWED"}}