The TIFF decoder does not enforce limits on tile sizes for tiled images, allowing a malicious or corrupt image to request an extremely large tile. This omission enables an attacker to trigger unbounded memory allocation, leading the decoder to consume progressively more RAM until the process or system exhausts memory, potentially causing denial of service.

The vulnerability specifically affects projects that use the golang.org/x/image image library, particularly the x/image/tiff codec. No version details are listed in the advisory, so any releases prior to a future fix are potentially impacted.

With a CVSS score of 7.5 and an EPSS score of < 1%, the vulnerability is considered high severity but not widely exploited in the public domain, and it is not listed in the CISA KEV catalog. The impact of the flaw is high due to the potential for arbitrary memory consumption, but the likelihood of exploitation depends on the exposure of the TIFF decoding functionality within the target environment. The attack vector is inferred to be local or remote, depending on whether the service processes untrusted image data.