Denial of service via crafted TIFF image in golang.org/x/image/tiff
Priority LOW 25CWE-770Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00306 23rd percentileScored 2026-11-07
Fix Fixed golang.org/x/image/tiff (golang.org/x/image): 0.5.0golang.org/x/image (Go): 0.5.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | golang.org/x/image/tiff | before 0.5.0 | 0.5.0 | Patch available | CNA |
| — | golang.org/x/image (Go) | before 0.5.0 | 0.5.0 | Patch available | GHSA-qgc7-mgm3-q253 |
- golang.org/x/image/tiff VendorGo standard library Affected before 0.5.0 Fixed in 0.5.0 Patch available CNA
- golang.org/x/image (Go) Vendor— Affected before 0.5.0 Fixed in 0.5.0 Patch available GHSA-qgc7-mgm3-q253
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:image:*:*:*:*:*:go:*:* | before 0.5.0 | Vulnerable | Go standard library |
| cpe:2.3:a:golang:tiff:-:*:*:*:*:go:*:* | not specified by NVD | Vulnerable | Go standard library |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
- cpe:2.3:a:golang:image:*:*:*:*:*:go:*:* Versions before 0.5.0 Vulnerable ·Go standard library
- cpe:2.3:a:golang:tiff:-:*:*:*:*:go:*:* Versions not specified by NVD Vulnerable ·Go standard library
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA golang.org/x/image/tiff (golang.org/x/image) Fixed in 0.5.0
- Fix · GHSA-qgc7-mgm3-q253 golang.org/x/image (Go) Fixed in 0.5.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 29 products
- Cost Management Metrics Operator
- Cryostat 2
- Custom Metric Autoscaler operator for Red Hat Openshift
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Applications 6
- Migration Toolkit for Containers
- Migration Toolkit for Virtualization
- Node Maintenance Operator
- OpenShift API for Data Protection
- OpenShift Secondary Scheduler Operator
- OpenShift Serverless
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 3
- Red Hat Ceph Storage 5
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform Assisted Installer 1
- Red Hat OpenShift Data Science (RHODS)
- Red Hat OpenShift GitOps
- Red Hat OpenShift distributed tracing 2
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Container Storage 4
- Red Hat Openshift Data Foundation 4
- Red Hat Openshift Sandboxed Containers
- Red Hat Quay 3
- Service Telemetry Framework 1.4 for RHEL 8
- Service Telemetry Framework 1.5
- cert-manager Operator for Red Hat OpenShift
- mirror registry for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2022-41727
- 2026-10-03 Alias added: GHSA-qgc7-mgm3-q253
References
Patch 1
Advisory 5
- https://groups.google.com/g/golang-announce/c/ag-FiyjlD5o
- https://pkg.go.dev/vuln/GO-2023-1572
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2/
- https://nvd.nist.gov/vuln/detail/CVE-2022-41727
Other 5
- https://go.dev/issue/58003
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK
More Go standard library Image vulnerabilities
- TI-2026-26185 Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image CVSS 3.1HIGH 7.5
- TI-2023-13788 Excessive resource consumption in golang.org/x/image/tiff CVSS 3.1MEDIUM 6.5
- TI-2023-13787 Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff CVSS 3.1MEDIUM 6.5
- TI-2026-26184 Excessive memory allocation when decoding malicious SFNT in golang.org/x/image CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-41727 · CVE Program
- CVE-2022-41727 · NVD
- FIRST EPSS
- GHSA-qgc7-mgm3-q253 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-41727 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences