TI-2026-26185 CVE-2026-33813
Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image
Priority LOW 39
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
Go standard library
Records298All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical34CVSS 9.0–10.0
CVSS high164CVSS 7.0–8.9
Exploited now
Go standard library records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
5 records in Image · all components
TI-2023-13788 CVE-2023-29408 · GHSA-x92r-3vfx-4cv3
Excessive resource consumption in golang.org/x/image/tiff
Priority LOW 31
The TIFF decoder does not place a limit on the size of compressed tile data.
TI-2023-13787 CVE-2023-29407 · GHSA-j3p8-6mrq-6g7h
Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
Priority LOW 30
A maliciously-crafted image can cause excessive CPU consumption in decoding.
TI-2026-26184 CVE-2026-33812
Excessive memory allocation when decoding malicious SFNT in golang.org/x/image
Priority LOW 26
Parsing a malicious font file can cause excessive memory allocation.
TI-2022-20117 CVE-2022-41727 · GHSA-qgc7-mgm3-q253
Denial of service via crafted TIFF image in golang.org/x/image/tiff
Priority LOW 25
An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig.