Read the docs
TI-2026-34263 Aliases CVE-2026-46604

Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image

Priority MEDIUM 40CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 8 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00609 49th percentileScored 2026-11-07
Fix Partial golang.org/x/image/tiff (golang.org/x/image): 0.43.0Red Hat: 9 advisoriesRed Hat: 8 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarygolang.org/x/image/tiffbefore 0.43.00.43.0Patch availableCNA
  • golang.org/x/image/tiff VendorGo standard library Affected before 0.43.0 Fixed in 0.43.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:tiff:*:*:*:*:*:go:*:*before 0.43.0VulnerableGo standard library

Remediation

  • Fix · CNA golang.org/x/image/tiff (golang.org/x/image) Fixed in 0.43.0

Red Hat 9 advisories

  • RHSA-2026:95360 Released 2026-11-04 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-storage-rhel9
  • RHSA-2026:73419 Released 2026-09-29 · Red Hat rating Important
    Multicluster Global Hub 1.6.6 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:73038 Released 2026-09-29 · Red Hat rating Important
    Multicluster Global Hub 1.8.2 security update
    • Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
Show 6 more Red Hat advisories
  • RHSA-2026:71597 Released 2026-09-24 · Red Hat rating Important
    Multicluster Global Hub 1.5.8 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:70870 Released 2026-09-23 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.5.3
    • Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:68515 Released 2026-09-17 · Red Hat rating Important
    Multicluster Global Hub 1.8.2 security update
    • Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:67842 Released 2026-09-16 · Red Hat rating Important
    Multicluster Global Hub 1.7.3 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:67516 Released 2026-09-15 · Red Hat rating Important
    Multicluster Global Hub 1.4.9 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:66521 Released 2026-09-10 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.1
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Cryostat 4 on RHEL 9Fixed RHSA-2026:95360
Logging Subsystem for Red Hat OpenShift 6.5Fixed RHSA-2026:70870
Logging Subsystem for Red Hat OpenShift 6.6Fixed RHSA-2026:66521
Multicluster Global Hub 1.4.9Fixed RHSA-2026:67516
Multicluster Global Hub 1.5.8Fixed RHSA-2026:71597
Multicluster Global Hub 1.6.6Fixed RHSA-2026:73419
Multicluster Global Hub 1.7.4Fixed RHSA-2026:67842
Multicluster Global Hub 1.8.2Fixed RHSA-2026:68515, RHSA-2026:73038
Not affected: 15 products
  • Cryostat 4 on RHEL 9
  • Logging Subsystem for Red Hat OpenShift 6.5
  • Logging Subsystem for Red Hat OpenShift 6.6
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Multicluster Global Hub 1.6.6
  • Multicluster Global Hub 1.7.4
  • Multicluster Global Hub 1.8.2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenStack Platform 18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46604
  2. 2026-11-06 Fix available: Cryostat 4 on RHEL 9, Multicluster Global Hub 1.7.4 · Red Hat
  3. 2026-11-06 Fix available: RHSA-2026:95360 · Red Hat

References

Patch 1

Advisory 2

  • TI-2026-26181 OOM from malicious IFD offset in golang.org/x/image/tiff CVSS 3.1MEDIUM 5.3
  • TI-2022-20117 Denial of service via crafted TIFF image in golang.org/x/image/tiff CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences