A maliciously crafted TIFF file can force the Go image/tiff decoder to try allocating up to 4 GiB of memory, which may overwhelm the system or trigger an out‑of‑memory condition. The result is a denial of service by exhausting available resources.

The vulnerability exists in golang.org/x/image, specifically the golang.org/x/image/tiff package. Version information is not specified in the advisories, so any installation of this package that contains the buggy decoder may be affected.

With a CVSS score of 5.3 the severity is moderate. The EPSS score is less than 1% (approximately 0.00012), indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The vulnerability is triggered by supplying a crafted TIFF file; therefore, the likely attack vector is through arbitrary file processing, either locally by users who can supply files or remotely if the application accepts uploads. Exploitation requires only the presence of a vulnerable decoder and a malicious file. Once triggered, the service can be brought down or degraded by exhausting memory resources.