The TIFF decoder in the Go image library does not impose a limit on the size of PackBits‑compressed data. A maliciously crafted TIFF image can force the decoder to expand a compact payload into a vastly larger in‑memory structure. This uncontrolled expansion can deplete memory, trigger crashes, or significantly degrade system performance, effectively denying service to legitimate users or applications that rely on image decoding.

All deployments that use the golang.org/x/image package, specifically the tiff subpackage, are susceptible when they process externally supplied TIFF files. Any application or service incorporating this library without additional safeguards is at risk.

The vulnerability lacks a size limit for PackBits‑decoded data, allowing an attacker to provide a small‑looking TIFF file that expands to consume large amounts of memory during decompression. This can lead to memory exhaustion and application crashes or significant performance degradation. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, but the absence of bounds indicates a potentially high risk of resource exhaustion. The CVSS score is 7.5.