5.3

CVE-2026-33809: OOM from malicious IFD offset in golang.org/x/image/tiff

Analyzed
AliasesUBUNTU-CVE-2026-33809DEBIAN-CVE-2026-33809CGA-2hr9-926c-qcw7
Published 25-03-2026Last modified 06-04-2026

Vulnerability summary

CVE-2026-33809 is a medium (CVSS 5.3) vulnerability in golang tiff. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 26.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.33%
0%100%
Low · -0.05 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 9
OPENSUSE-SU-2026:10856-1OPENSUSE-SU-2026:11290-1OPENSUSE-SU-2026:20963-1OPENSUSE-SU-2026:21436-1OPENSUSE-SU-2026:21483-1RHSA-2026:7291

Timeline

  1. 25-03-2026
    PublishedVulnerability first disclosed.
  2. 06-04-2026
    Last modifiedVulnerability information updated.

Description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.33%

Chance of exploitation in the next 30 days

Percentile

27%

Versus all other CVEs

30-day change

Decrease -0.05 pp

From 0.39% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard67 products
  • cgAll versions (No fix recorded)
  • chainctlAll versions (No fix recorded)
  • chainctl-fipsAll versions (No fix recorded)
  • gatusAll versions (No fix recorded)
  • gatus-fipsAll versions (No fix recorded)
Wolfi15 products
  • gatusAll versions (No fix recorded)
  • giteaAll versions (No fix recorded)
  • glabAll versions (No fix recorded)
  • hugo< 0.159.1-r1
  • hugo-extended< 0.159.0-r1
Alpine1 product
  • rclone< 1.73.5-r0
Debian1 product
  • golang-golang-x-imageAll versions (No fix recorded) | < 0.38.0-1
Golang1 product
Golang.org/x1 product
  • image< 0.38.0
Golang.org/x/image1 product
Opensuse1 product
  • pocketbase&distro=openSUSE Tumbleweed< 0.37.3-1.1
Ubuntu1 product
  • golang-golang-x-imageAll versions (No fix recorded)

9 vendors · 89 products

References

11 links
Show all 11 references