High severity7.5NVD Advisory· Published Jun 26, 2026· Updated Jul 1, 2026
CVE-2026-46604
CVE-2026-46604
Description
The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.
Affected products
47- osv-coords46 versionspkg:apk/chainguard/bentopkg:apk/chainguard/cgpkg:apk/chainguard/chainctlpkg:apk/chainguard/chainctl-fipspkg:apk/chainguard/gatuspkg:apk/chainguard/gatus-fipspkg:apk/chainguard/gitlab-workhorse-ce-18.11pkg:apk/chainguard/gitlab-workhorse-ce-18.9pkg:apk/chainguard/gitlab-workhorse-ce-19.0pkg:apk/chainguard/gitlab-workhorse-ce-19.1pkg:apk/chainguard/gitlab-workhorse-ce-fips-18.11pkg:apk/chainguard/gitlab-workhorse-ce-fips-19.0pkg:apk/chainguard/gitlab-workhorse-ce-fips-19.1pkg:apk/chainguard/glabpkg:apk/chainguard/hugopkg:apk/chainguard/kubescapepkg:apk/chainguard/kubescape-serverpkg:apk/chainguard/kubescape-server-downloaderpkg:apk/chainguard/kubescape-server-fipspkg:apk/chainguard/kubescape-server-fips-downloaderpkg:apk/chainguard/listmonkpkg:apk/chainguard/mattermost-11.1pkg:apk/chainguard/mattermost-11.7pkg:apk/chainguard/mattermost-11.8pkg:apk/chainguard/mattermost-fips-11.1pkg:apk/chainguard/rclonepkg:apk/chainguard/rclone-fipspkg:apk/chainguard/seaweedfspkg:apk/chainguard/seaweedfs-fipspkg:apk/chainguard/seaweedfs-operatorpkg:apk/chainguard/seaweedfs-operator-fipspkg:apk/chainguard/tailscalepkg:apk/wolfi/bentopkg:apk/wolfi/gatuspkg:apk/wolfi/glabpkg:apk/wolfi/hugopkg:apk/wolfi/kubescapepkg:apk/wolfi/mattermost-11.1pkg:apk/wolfi/mattermost-11.7pkg:apk/wolfi/rclonepkg:apk/wolfi/seaweedfspkg:apk/wolfi/tailscalepkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/keybase-client&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/keybase-client&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/kitty&distro=openSUSE%20Tumbleweed
< 0+ 45 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 18.11.6-r1
- (no CPE)range: < 18.9.8-r4
- (no CPE)range: < 19.0.3-r1
- (no CPE)range: < 19.1.1-r1
- (no CPE)range: < 18.11.6-r1
- (no CPE)range: < 19.0.3-r3
- (no CPE)range: < 19.1.1-r1
- (no CPE)range: < 0
- (no CPE)range: < 0.163.3-r1
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 6.2.0-r1
- (no CPE)range: < 11.10.0-r0
- (no CPE)range: < 11.7.6-r3
- (no CPE)range: < 11.8.3-r1
- (no CPE)range: < 11.10.0-r0
- (no CPE)range: < 1.74.3-r5
- (no CPE)range: < 1.74.3-r2
- (no CPE)range: < 4.36-r2
- (no CPE)range: < 4.36-r3
- (no CPE)range: < 1.0.29-r2
- (no CPE)range: < 1.0.29-r1
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0.163.3-r1
- (no CPE)range: < 0
- (no CPE)range: < 11.10.0-r0
- (no CPE)range: < 11.7.6-r3
- (no CPE)range: < 1.74.3-r5
- (no CPE)range: < 4.36-r2
- (no CPE)range: < 0
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
- (no CPE)range: < 6.6.3-bp160.1.1
- (no CPE)range: < 6.6.3-2.1
- (no CPE)range: < 0.47.4-2.1
Patches
Vulnerability mechanics
References
3- go.dev/cl/788421nvdPatch
- go.dev/issue/80122nvdVendor Advisory
- pkg.go.dev/vuln/GO-2026-5066nvdVendor Advisory
News mentions
0No linked articles in our index yet.