High severity7.5NVD Advisory· Published May 29, 2026· Updated Jul 22, 2026
CVE-2026-46599
CVE-2026-46599
Description
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
golang.org/x/imageGo | < 0.41.0 | 0.41.0 |
Affected products
24- osv-coords22 versionspkg:apk/chainguard/seaweedfs-fipspkg:apk/chainguard/seaweedfs-rocksdb-fipspkg:apk/chainguard/glabpkg:apk/chainguard/seaweedfspkg:apk/chainguard/chainctl-fipspkg:apk/chainguard/seaweedfs-operator-fipspkg:apk/wolfi/gatuspkg:apk/chainguard/chainctlpkg:apk/chainguard/gitlab-workhorse-ce-18.9pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/seaweedfs-operatorpkg:apk/chainguard/gitlab-workhorse-ce-fips-18.10pkg:apk/chainguard/seaweedfs-rocksdbpkg:apk/chainguard/gatuspkg:apk/chainguard/gitlab-workhorse-ce-18.10pkg:apk/wolfi/tailscalepkg:apk/chainguard/mattermost-fips-11.2pkg:apk/wolfi/seaweedfspkg:apk/chainguard/cgpkg:apk/wolfi/glabpkg:apk/chainguard/tailscalepkg:apk/chainguard/gatus-fips
< 4.34-r1+ 21 more
- (no CPE)range: < 4.34-r1
- (no CPE)range: < 4.34-r1
- (no CPE)range: < 0
- (no CPE)range: < 4.34-r1
- (no CPE)range: < 0
- (no CPE)range: < 1.0.26-r1
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 18.9.8-r3
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
- (no CPE)range: < 1.0.26-r1
- (no CPE)range: < 18.10.8-r1
- (no CPE)range: < 4.34-r1
- (no CPE)range: < 0
- (no CPE)range: < 18.10.8-r1
- (no CPE)range: < 0
- (no CPE)range: < 11.2.4-r13
- (no CPE)range: < 4.34-r1
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-q675-qj96-32m9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-46599ghsaADVISORY
- cs.opensource.google/go/x/imageghsaPACKAGE
- go.dev/cl/759960nvdWEB
- go.dev/issue/79577nvdWEB
- groups.google.com/g/golang-announce/c/uhYX90BlBvInvdWEB
- pkg.go.dev/vuln/GO-2026-5032nvdWEB
News mentions
0No linked articles in our index yet.