CVE-2026-33809Disclosure(golang / tiff)

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

golang CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://pkg.go.dev/vuln/GO-2026-4815

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

tiff

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-03-25); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

golang

Products

tiff

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-25	2	Disclosure2
2026-08-10	1	Disclosure1

Full discourse3 posts

lifcc@mylifcc62d
Disclosure
实际成果不虚。对 21 个 Go 包做了超过 8000 万次 grammar-based fuzzing，挖出两个 OOM： CVE-2026-33809（x/image/tiff） CVE-2026-33812（x/image/font/sfnt）另外还有一条完整的 OEM 服务 0day 链：认证绕过 → SSRF → 目录注入 → BYOVD → SYSTEM。 macOS 发行平台也有两个问题被确认。
Post summary
The post announces the discovery of two out‑of‑memory bugs in Go image packages (CVE‑2026‑33809, CVE‑2026‑33812) through extensive fuzzing, and notes additional zero‑day exploitation chains and macOS platform issues.
10000491
6.1K followersView on X
CVE@CVEnew199d
Disclosure
CVE-2026-33809 A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory e… https://www.cve.org/CVERecord?id=CVE-2026-33809
Post summary
The tweet announces CVE‑2026‑33809, noting how a crafted TIFF file can force image decoding to allocate up to 4 GiB of memory, leading to resource exhaustion, with no mention of PoC, active exploitation, or fixes.
00010122
56.8K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash199d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33809 - OOM from malicious IFD offset in http://golang.org/x/image/tiff Intel Report: https://ift.tt/kZKAn7a
Post summary
A newly identified CVE-2026-33809 causes an OOM in golang.org/x/image/tiff via a malicious IFD offset; the Intel report link is provided, but no PoC, active exploitation, or patch details are disclosed.
0000021
286 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	golang	tiff	-	go	-

Explore more

Back to dashboard golang CVEs tiff vulnerabilities

What researchers are saying

CVE-2026-33809

lifcc[verified]@mylifccDisclosure

The post announces the discovery of two out‑of‑memory bugs in Go image packages (CVE‑2026‑33809, CVE‑2026‑33812) through extensive fuzzing, and notes additional zero‑day exploitation chains and macOS platform issues.

CVE@CVEnewDisclosure

The tweet announces CVE‑2026‑33809, noting how a crafted TIFF file can force image decoding to allocate up to 4 GiB of memory, leading to resource exhaustion, with no mention of PoC, active exploitation, or fixes.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

A newly identified CVE-2026-33809 causes an OOM in golang.org/x/image/tiff via a malicious IFD offset; the Intel report link is provided, but no PoC, active exploitation, or patch details are disclosed.