TI-2026-26181 Aliases CVE-2026-33809 GHSA-44p7-9xx4-hf2g

OOM from malicious IFD offset in golang.org/x/image/tiff

LOW 30CWE-434Published 2026-03-25 · Updated 2026-04-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution, Denial of service
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 1 fixed, 10 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-434 and CWE-770.

Summary

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00334 26th percentileScored 2026-11-07

Fix Partial golang.org/x/image/tiff (golang.org/x/image): 0.38.0golang.org/x/image (Go): 0.38.0Red Hat: 2 advisoriesRed Hat: 1 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Go standard library	golang.org/x/image/tiff	before 0.38.0	0.38.0	Patch available	CNA
—	golang.org/x/image (Go)	before 0.38.0	0.38.0	Patch available	GHSA-44p7-9xx4-hf2g

golang.org/x/image/tiff VendorGo standard library Affected before 0.38.0 Fixed in 0.38.0 Patch available CNA
golang.org/x/image (Go) Vendor— Affected before 0.38.0 Fixed in 0.38.0 Patch available GHSA-44p7-9xx4-hf2g

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:golang:tiff::::::go::*	before 0.38.0	Vulnerable	Go standard library

cpe:2.3:a:golang:tiff:*:*:*:*:*:go:*:* Versions before 0.38.0 Vulnerable ·Go standard library

Remediation

Fix · CNA golang.org/x/image/tiff (golang.org/x/image) Fixed in 0.38.0
Fix · GHSA-44p7-9xx4-hf2g golang.org/x/image (Go) Fixed in 0.38.0 Advisory →

Red Hat 2 advisories

RHSA-2026:7385 Released 2026-04-10 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images golang1.25-1.25.9-1.hum1@aarch64, golang1.25-1.25.9-1.hum1@src, golang1.25-1.25.9-1.hum1@x86_64 +12
RHSA-2026:7291 Released 2026-04-09 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images golang1.26-1.26.2-1.hum1@aarch64, golang1.26-1.26.2-1.hum1@src, golang1.26-1.26.2-1.hum1@x86_64 +12

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Cryostat 4	Affected	No fix yet: Fix deferred
Logging Subsystem for Red Hat OpenShift	Affected	No fix yet: Fix deferred
OpenShift Service Mesh 2	Affected	No fix yet: Fix deferred
OpenShift Service Mesh 3	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift Virtualization 4	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:7291, RHSA-2026:7385

Timeline

2026-10-02 Threatist record created from CVE-2026-33809
2026-10-03 Alias added: GHSA-44p7-9xx4-hf2g

References

Advisory 2

Other 3

TI-2026-34263 Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image CVSS 3.1HIGH 7.5
TI-2022-20117 Denial of service via crafted TIFF image in golang.org/x/image/tiff CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences