CVE-2026-46604: Golang Tiff DOS Vulnerability

CVE-2026-46604 Overview

CVE-2026-46604 affects the golang.org/x/image/tiff package. The TIFF decoder panics when it processes an invalid image containing an out-of-bounds strip offset. An attacker who supplies a crafted TIFF file to an application using the library can trigger a runtime panic and cause a denial of service. The flaw is network-reachable, requires no authentication, and needs no user interaction. It affects availability only, with no impact on confidentiality or integrity. The issue is tracked as GO-2026-5066 and is categorized under [CWE-787] Out-of-bounds Write.

Critical Impact
A crafted TIFF image can crash any Go service that decodes untrusted images using golang.org/x/image/tiff, resulting in denial of service.

Affected Products

Golang golang.org/x/image/tiff package
Go applications importing golang:tiff for image decoding
Services accepting user-supplied TIFF files via cpe:2.3:a:golang:tiff:*:*:*:*:*:go:*:*

Discovery Timeline

2026-06-26 - CVE-2026-46604 published to the National Vulnerability Database (NVD)
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-46604

Vulnerability Analysis

The defect resides in the TIFF decoder of the Go x/image module. When the decoder parses an image, it reads strip offsets from the TIFF Image File Directory (IFD) entries. If a strip offset points outside the bounds of the underlying image data, the decoder does not validate the offset before dereferencing it. The resulting out-of-bounds access causes the Go runtime to panic. Unless the caller wraps the decode operation in a recover(), the panic terminates the goroutine or process. Services that decode TIFF images inline, such as thumbnail generators, document processors, and web upload handlers, are directly exposed.

Root Cause

The decoder trusts the strip offset field within the TIFF metadata without verifying it against the length of the input buffer. This missing bounds check maps to [CWE-787] Out-of-bounds Write. The behavior surfaces as a runtime panic rather than memory corruption because Go's runtime intercepts the invalid access.

Attack Vector

An unauthenticated remote attacker delivers a malformed TIFF image to any endpoint that invokes the vulnerable decoder. The trigger requires only that the target parse the file. Repeated submissions can sustain a denial-of-service condition against image-processing pipelines. No credentials, prior access, or user interaction are required.

No public proof-of-concept exploit has been published. See the Go.dev Vulnerability Report for maintainer analysis and the Go.dev Code Review for the corrective changes.

Detection Methods for CVE-2026-46604

Indicators of Compromise

Unexpected process termination or goroutine panics in Go services that decode TIFF images.
Application logs containing panic traces referencing image/tiff decoder functions.
Spikes in HTTP 5xx responses correlated with TIFF uploads or image-processing requests.

Detection Strategies

Run govulncheck against build artifacts to flag modules importing vulnerable versions of golang.org/x/image/tiff.
Inspect dependency manifests (go.mod, go.sum) for references to golang.org/x/image at pre-patch versions.
Add fuzz cases to CI that submit malformed TIFF files with invalid strip offsets to image endpoints.

Monitoring Recommendations

Alert on repeated panics or restarts of image-processing workers within short intervals.
Monitor upload endpoints for unusual TIFF submission patterns from single sources.
Forward Go application panic logs to a centralized SIEM for correlation with request telemetry.

How to Mitigate CVE-2026-46604

Immediate Actions Required

Upgrade golang.org/x/image to the version containing the fix referenced in Go.dev Code Review CL/788421.
Rebuild and redeploy all Go binaries that link against the vulnerable module.
Audit services that accept user-supplied TIFF files and restrict access where feasible.

Patch Information

The Go team addressed the defect in the change set published at Go.dev Code Review CL/788421. Tracking details are available in the Go.dev Issue Tracker (#80122) and the Go.dev Vulnerability Report GO-2026-5066. Update golang.org/x/image using go get -u golang.org/x/image and verify remediation with govulncheck ./....

Workarounds

Validate TIFF headers and file sizes at the application boundary before invoking the decoder.
Isolate image decoding in a sandboxed worker process so panics do not crash the parent service.
Wrap TIFF decode calls with defer recover() to convert panics into handled errors until patching completes.
Temporarily reject TIFF uploads on internet-facing endpoints if patching is delayed.

bash

# Configuration example
go get -u golang.org/x/image@latest
go mod tidy
govulncheck ./...