CVE-2026-46604

Go/golang.org/x/image CVE-2026-46604: unknown, EPSS 0.61%

Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image

Action: Upgrade golang.org/x/image to 0.43.0 or later.

go get golang.org/x/image@v0.43.0

Affected

Fixed versions

Sources

• osv: GO-2026-5066
• https://go.dev/cl/788421
• https://go.dev/issue/80122

CVE-2026-46604 · published 2026-06-26T20:04:13Z · modified 2026-06-27T06:14:20.408848742Z · JSON