CVE-2024-24792

Vulnerability

In the Go package x/image/tiff, when decoding a paletted TIFF image, the parser does not validate color indices against the palette size. A crafted image with indices outside the valid range is successfully parsed but later causes a panic when the At method accesses the color palette [2].

Exploitation

An attacker can trigger the vulnerability by supplying a specially crafted TIFF file. No authentication is required; any application that uses tiff.Decode on untrusted input is affected. The provided reproducer demonstrates a panic with an index out of range error, leading to program termination [2].

Impact

Successful exploitation results in a denial-of-service condition, as the panic crashes the application. The issue is rated CVSS 7.5 (High) [1].

Mitigation

The vulnerability is fixed in a subsequent release of golang.org/x/image. Users should update to the latest version of the package. The Go vulnerability database entry GO-2024-2937 [3] and the associated commit [1] provide details and patches.