CVE-2022-41727: Fedoraproject Fedora

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.

Affected products

• Fedoraproject Fedora: version 37 only; version 38 only
• Golang Image: before 0.5.0 (fixed in 0.5.0)
• Golang Tiff: affected versions not specified

Published 2023-02-28. Last modified 2026-06-17.