Fluid Attacks Database

Description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
rpm rhel9	golang	-	-
debian 13	golang-golang-x-image	=0.18.0-1 \|\| =0.32.0-1 \|\| =0.35.0-1 \|\| =0.38.0-1 \|\| =0.39.0-1	-
go	golang.org/x/image	>=0 <0.38.0	0.38.0
rpm rhel10	golang	-	-
rpm rhel8	golang	-	-
debian 11	golang-golang-x-image	=0.0~git20200119.58c2397-1 \|\| =0.0~git20210628.a66eb64-1 \|\| =0.0~git20211028.6944b10-1 \|\| =0.0~git20211028.6944b10-1~bpo11+1 \|\| =0.1.0-1 \|\| =0.11.0-1 \|\| =0.12.0-1 \|\| =0.13.0-1 \|\| =0.14.0-1 \|\| =0.15.0-1 \|\| =0.16.0-1 \|\| =0.18.0-1 \|\| =0.2.0-1 \|\| =0.32.0-1 \|\| =0.35.0-1 \|\| =0.38.0-1 \|\| =0.39.0-1 \|\| =0.5.0-1 \|\| =0.7.0-1 \|\| =0.8.0-1 \|\| =0.9.0-1	-
debian 12	golang-golang-x-image	=0.11.0-1 \|\| =0.12.0-1 \|\| =0.13.0-1 \|\| =0.14.0-1 \|\| =0.15.0-1 \|\| =0.16.0-1 \|\| =0.18.0-1 \|\| =0.32.0-1 \|\| =0.35.0-1 \|\| =0.38.0-1 \|\| =0.39.0-1 \|\| =0.5.0-1 \|\| =0.7.0-1 \|\| =0.8.0-1 \|\| =0.9.0-1	-
debian 14	golang-golang-x-image	=0.18.0-1 \|\| =0.32.0-1 \|\| =0.35.0-1 \|\| >=0 <0.38.0-1	0.38.0-1

Aliases

1. CVE-2026-338092. NVD-2026-338093. OSV-2026-338094. OSV-DEBIAN-2026-338095. GCVE-2026-338096. SECURITY-TRACKER-CVE-2026-33809

References

1. https://go.dev/cl/7576602. https://go.dev/issue/782673. https://pkg.go.dev/vuln/GO-2026-4815

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.