CVE-2026-33809

Aliases:GO-2026-4815GHSA-44p7-9xx4-hf2g
Advisory lineage Upstream: 0 Downstream: 9
Analyzed
Published: 25 Mar 2026, 18:24
Last modified:06 Apr 2026, 21:12

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
5.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.33% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

25 Mar 2026, 18:24
Published
Vulnerability first disclosed
06 Apr 2026, 21:12
Last Modified
Vulnerability information updated

Description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Trends

Current EPSS score: 0.33%• Percentile: 25%

Techniques & Countermeasures

  • CWE-434•Unrestricted Upload of File with Dangerous Type

    The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Affected Systems

  • golang.org/x•image

    < 0.38.0

  • golang•tiff

    < 0.38.0

  • golang.org/x/image•golang.org/x/image/tiff

    < 0.38.0

References (5)