CVE-2026-33809: Golang Tiff

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Affected products

• Golang Tiff: before 0.38.0 (fixed in 0.38.0)

Published 2026-03-25. Last modified 2026-06-17.