Go/golang.org/x/image CVE-2026-33809: medium 5.3, EPSS 0.33%

OOM from malicious IFD offset in golang.org/x/image/tiff

Action: Upgrade golang.org/x/image to 0.38.0 or later.

go get golang.org/x/image@v0.38.0

Affected

Fixed versions

Sources

• osv: GO-2026-4815
• nvd: CVE-2026-33809
• https://go.dev/cl/757660
• https://go.dev/issue/78267

CVE-2026-33809 · published 2026-03-25T18:02:02Z · modified 2026-05-15T10:59:23.820275876Z · JSON