CVE-2026-46599: golang.org/x/image golang.org/x/image/tiff
CVSS: 7.5v3.1HighDeferred
AliasesUBUNTU-CVE-2026-46599DEBIAN-CVE-2026-46599CGA-3c3x-m552-99r7CGA-76p4-5rff-c9c8CGA-8pw6-3x5w-6233CGA-8xqx-2722-hcj8CGA-m529-8mqm-fqf6CGA-mgr9-747x-72whCGA-q3f4-2vxg-c2v8CGA-v3v4-pfcc-x4jrGHSA-q675-qj96-32m9GO-2026-5032CGA-224r-c642-x6mvCGA-2qc7-xgmr-m44qCGA-2rvg-96ff-wwrjCGA-2wm4-p39g-c259CGA-3hjx-6jv4-m7f9CGA-3jmm-w3wq-g3c9CGA-3m83-4x9v-xcpjCGA-3x9m-r74x-4w6hCGA-4249-crx7-7pmgCGA-4375-v5jh-6chcCGA-43qh-47m8-6hpfCGA-48ff-hh9w-82gvCGA-4hff-226r-w84wCGA-52x2-rfwq-c6ccCGA-57m3-w2mf-6v6xCGA-58xw-mqfh-r6gqCGA-5j4f-rm4w-x5v7CGA-5jv5-8gcp-54hrCGA-5q3g-6vjm-f555CGA-648j-jg6c-mp8wCGA-668p-6g37-pq7rCGA-6cm4-v376-hvgwCGA-6fc7-54pq-hh8gCGA-6mrw-66cr-m72rCGA-6r7w-h5ph-7p3qCGA-73xw-22fh-4r6pCGA-89jh-wr6m-w5r4CGA-8r8m-6xqj-r9hxCGA-8xgg-5mp9-qr57CGA-97cp-xx49-83g2CGA-9fc4-876p-8mfxCGA-9mgc-7g8q-43gvCGA-9rpw-92g7-h2jrCGA-f739-v5hr-6rwjCGA-fpjf-8mm6-gcx5CGA-fpp9-v5hx-wppgCGA-g54c-q564-9hc9CGA-g7v5-3252-h8wcCGA-gjq2-9mmf-f959CGA-gwgx-mj3w-v9x6CGA-gx24-wrm3-w76vCGA-h3rg-mc68-97p4CGA-h4fc-32w6-gjj5CGA-h57h-7rr5-vcqxCGA-hff7-9583-f886CGA-hghx-jx36-c4mgCGA-hmr9-vvx8-8pjfCGA-hqj6-7j5q-cqqxCGA-j4m9-hpr3-95mjCGA-j4x9-7q9w-frmhCGA-j752-9v6m-2qr3CGA-jq65-8w8v-8vq7CGA-jrjm-rmfx-cw53CGA-jvc8-47gj-m997CGA-m2q5-j9mg-8jgrCGA-mhhf-g2j2-6q5qCGA-mj6v-f4rq-v6xcCGA-mr8p-wx97-r4x3CGA-mww9-m8hm-xjf5CGA-mx87-778g-q3wgCGA-p287-2fvq-qgm9CGA-p696-hpww-9wc8CGA-pc63-w4xw-xgrcCGA-ph77-x4p3-5jrmCGA-pvxq-5q95-w3jxCGA-pwx8-5c7g-28hvCGA-q53x-9732-9hf4CGA-q9c3-52m3-wp4wCGA-qccc-43hx-4g4fCGA-qfp6-4qv4-r6cwCGA-qq5v-8fq9-v45jCGA-qq72-prhh-mfhqCGA-qrhx-53wf-hw7gCGA-r62m-xq5f-rr59CGA-rmqr-jrqj-m73mCGA-rmwf-jg7m-jf8fCGA-v2fh-jq9f-g6ccCGA-vm8h-mq4c-78c5CGA-vq29-43jc-g5rwCGA-vvx9-gvvp-fhvxCGA-w6fv-369m-x63hCGA-wvqx-f5mm-wc3wCGA-wxfm-6r95-hqrpCGA-x3fr-vvhw-fhjxCGA-x76h-rfwr-hfj2CGA-xff9-8g4w-mv4pCGA-xph9-p6qc-g5h4CGA-xq85-4qx8-j8gmCGA-xrwp-5rcr-2qrpCGA-xwp5-f8wq-7qw7
Published 29-05-2026Last modified 01-06-2026
Vulnerability summary
CVE-2026-46599 is a high (CVSS 7.5) vulnerability in golang.org/x/image golang.org/x/image/tiff. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.2% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.63%
0%100%
Low · +0.28 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 29-05-2026PublishedVulnerability first disclosed.
- 01-06-2026Last modifiedVulnerability information updated.
Description
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
+0.28 pp
From 0.35% on 20-09-2026
20-09-202620-10-2026
EPSS score0.63%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard33 products
- cgAll versions (No fix recorded)
- chainctlAll versions (No fix recorded)
- chainctl-fipsAll versions (No fix recorded)
- commercial-chainloop-backendAll versions (No fix recorded)
- gatusAll versions (No fix recorded)
Wolfi4 products
- gatusAll versions (No fix recorded)
- glabAll versions (No fix recorded)
- seaweedfs< 4.34-r1
- tailscaleAll versions (No fix recorded)
Debian1 product
- golang-golang-x-imageAll versions (No fix recorded) | < 0.42.0-1
Golang.org/x1 product
- image< 0.41.0
Golang.org/x/image1 product
- golang.org/x/image/tiff< 0.41.0
Ubuntu1 product
- golang-golang-x-imageAll versions (No fix recorded)
6 vendors · 41 products
