Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the golang.org/x/image/tiff package, where the unpackBits function, responsible for decompressing PackBits data, lacked a crucial size check on the output. This allowed a specially crafted TIFF file with a small compressed size to trigger a massive memory allocation during decompression, leading to a denial of service. The analysis of the patch commit fe8ae458fe5e09e39a635719a8c2ec5393d0e815 clearly shows the introduction of a size limit (lim) to the unpackBits function in tiff/compress.go. The higher-level tiff.Decode function in tiff/reader.go was also modified to pass this limit when calling unpackBits for PackBits-compressed data. Therefore, both tiff.unpackBits (the function with the core vulnerability) and tiff.Decode (the function that invokes the vulnerable code path during image processing) would appear in a runtime profile during the exploitation of this vulnerability.
tiff.unpackBitstiff/compress.go
tiff.Decodetiff/reader.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| golang.org/x/image | go | < 0.41.0 | 0.41.0 |