Golang.org/x/image vulnerabilities
Published CVEs affecting Golang.org/x/image products: 9 record(s), with severity, exploitation and fixes.
Golang.org/x/image/tiff 4Golang.org/x/image/webp 2Golang.org/x/image/font/sfnt 1Golang.org/x/image/bmp 1Golang.org/x/image/vp8l 1
CVE-2026-46603
High · 7.5
CWE-789 Aug 14, 2026
Excessive memory allocation during VP8L decoding in golang.org/x/image
VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.
CVE-2026-46604
High · 7.5
CWE-787 Jun 26, 2026
Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image
The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.
CVE-2026-46602
High · 7.5
Jun 25, 2026
Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
CVE-2026-46601
High · 7.5
Jun 25, 2026
Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
CVE-2026-46599
High · 7.5
CWE-770 May 29, 2026
Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
CVE-2026-42500
Medium · 5.3
May 29, 2026
Panic when reading out of bound palette index in golang.org/x/image/bmp
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.
CVE-2026-33813
High · 7.5
Apr 21, 2026
Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
CVE-2026-33812
Medium · 6.1
CWE-770 Apr 21, 2026
Excessive memory allocation when decoding malicious SFNT in golang.org/x/image
Parsing a malicious font file can cause excessive memory allocation.
CVE-2026-33809
Medium · 5.3
CWE-434 Mar 25, 2026
OOM from malicious IFD offset in golang.org/x/image/tiff
A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.