Golang.org/x/image Golang.org/x/image/tiff vulnerabilities

3 CVEs affecting Golang.org/x/image Golang.org/x/image/tiff, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-46602, published 2026-06-25.

More from Golang.org/x/image.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-24792, published 2024-06-27. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Parsing a corrupt or malicious image with invalid color indices can cause a panic.
• CVE-2026-46599, published 2026-05-29. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded…
• CVE-2026-46602, published 2026-06-25. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.