CVE-2026-33809

OOM from malicious IFD offset in golang.org/x/image/tiff

5.3 MediumFix available

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.33%Up 0.3 points since Mar 26, 2026

What each source reports

CVE List Score used 5.3

OOM from malicious IFD offset in golang.org/x/image/tiff

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Record: CVE-2026-33809
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

EUVDEUVD-2026-15960 5.3

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Record: EUVD-2026-15960
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-44p7-9xx4-hf2g 5.3

Go Images vulnerable to an out-of-memory error via a crafted TIFF file

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Record: GHSA-44p7-9xx4-hf2g
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-434, CWE-770
Updated: 2026-11-02

NVD 5.3

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Record: CVE-2026-33809
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-434
Updated: 2026-11-02

OSVALPINE-CVE-2026-33809 5.3

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Record: ALPINE-CVE-2026-33809
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-03

OSVDEBIAN-CVE-2026-33809 5.3

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Record: DEBIAN-CVE-2026-33809
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

Show 13 moreShow less

OSVGHSA-44p7-9xx4-hf2g 5.3

Go Images vulnerable to an out-of-memory error via a crafted TIFF file

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Record: GHSA-44p7-9xx4-hf2g
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-434, CWE-770
Updated: 2026-11-02

OSVRHSA-2026:7291 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:7291
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Updated: 2026-11-02

OSVRHSA-2026:7385 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:7385
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-33809 5.3

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Record: UBUNTU-CVE-2026-33809
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVGO-2026-4815 No score

OOM from malicious IFD offset in golang.org/x/image/tiff

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Record: GO-2026-4815
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10628-1 No score

pocketbase-0.37.3-1.1 on GA media

These are all security issues fixed in the pocketbase-0.37.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10628-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10856-1 No score

rclone-1.74.2-1.1 on GA media

These are all security issues fixed in the rclone-1.74.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10856-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11290-1 No score

gomuks-26.03+git.1780250926.564a8707-1.1 on GA media

These are all security issues fixed in the gomuks-26.03+git.1780250926.564a8707-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11290-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20902-1 No score

Security update for keybase-client

This update for keybase-client fixes the following issues:

Changes in keybase-client:

golang.org/x/crypto/ssh: Fixed multiple issues: CVE-2026-39827, CVE-2026-39834, CVE-2026-39828, CVE-2026-39829, CVE-2026-39831, CVE-2026-42508, CVE-2026-39833, CVE-2026-39830, CVE-2026-39832, CVE-2026-46597, CVE-2026-46598, CVE-2026-46595, CVE-2026-39835 (boo#1266158)
CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (boo#1266596).
Update to version 6.6.2
- Improve git default branch handling
CVE-2026-33809: golang.org/x/image/tiff: excessive resource consumption due to large allocation attempt when decoding maliciously crafted TIFF file (bsc#1260696)
Switch to go1.25 as required by update go image library.
Update to version 6.6.0
- Various bug fixes and performance improvements
CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258591).
CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254023).
CVE-2025-58181: keybase-client: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253864).
CVE-2025-47913: keybase-client: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253563).
Update to version 6.5.1
- Fix team deletion not working
- Chat attachments improvements
- Miscellaneous bugfixes

Record: openSUSE-SU-2026:20902-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20963-1 No score

Security update for neonmodem

This update for neonmodem fixes the following issues:

Changes in neonmodem:

Update golang.org/x/net dependency to v0.55.0 due to bsc#1267193
Update golang.org/x/image dependency to v0.38.0 due to bsc#1260727
Update golang.org/x/term dependency to v0.42.0 due to bsc#1260727
Update to version 1.0.7+git0.346d1d3:
- Update dependencies, remove debug output
- Update GitHub actions
- discourse: APi fixes
- Bump golang.org/x/net from 0.36.0 to 0.38.0
- Bump golang.org/x/net from 0.34.0 to 0.36.0
- Update dependencies
- Change chat button
Add build option for position-independent executables

Record: openSUSE-SU-2026:20963-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21436-1 No score

Security update for rclone

This update for rclone fixes the following issues:

Changes in rclone:

Update to version 1.74.4 (boo#1267192):
- Version v1.74.4
- gui: update embedded release to 1.1.10
- local: stop --links symlinks escaping the destination directory CVE-2026-54572
- local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw
- s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc
- serve restic: fix --private-repos isolation bypass CVE-2026-59733
- archive extract: fix path traversal letting archives escape the destination CVE-2026-59732
- serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v
- build: fix multiple CVEs by upgrading to go1.26.5
- s3: fix mounting a prefix failing with 403 when HEAD is not permitted
- drive, googlephotos: warn when using rclone's shared client_id #9580
- drive: fix stray %!(EXTRA) in unexportable google document log message
- serve/http: fix --disable-zip so it works over rc
- serve webdav: fix MOVE overwrite failing without Overwrite header
- fs: fix negative offset when a suffix Range request exceeds object size
- accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs
- cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets
- cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers
- cmd/mount2: fix NFS file creation by implementing Mknod
- smb: fix for IBM iSeries and signature verification
- mega: fix hard deleted files reappearing in listings - fixes #9554
- mega: wait for server events after upload, delete and move
- vfs: fix hang reopening a file during the handle-caching grace period
- s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391
- fs: fix command line flag being ignored when set to its default value
- docs: fix copy to clipboard functionality for code blocks
- fs/operations: correct DeleteFile --backup-dir documentation
- build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities
- docs: clarify copyto command description - Fixes #9527
- docs: fix typo in remote setup docs
- serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188
- - s3: fix error mapping in GetObject to match HeadObject
- filter: fix --files-from copy stopping at the first unreadable file
- docs: Fix RELEASE.md
- ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0
- completion: fix powershell completion corrupting non-ASCII names - fixes #9412
- docs/crypt: fix encrypted size example - Fixes #9202
- docs: drive: note Google verification exemption for personal use apps
- rc: document that rc API access is equivalent to shell access
- docs: drive: update documentation about "Computers" folder
- accounting: fix goroutine leak in ResetCounters
- docs: fix --windows-event-log-level help
- backend/filelu: fix recursive listing path handling and file filtering
- docs: bisync - clarify flag interaction and minor changes
- docs: Update RELEASE.md to use cherry-pick -x
- webdav: fix mixed property statuses in multi-status responses
- s3: remove session token on cross-host redirects
- drive: warn when non-exportable Google documents are skipped - #9475
- Start v1.74.4-DEV development
update x/image to 0.43 (bsc#1271056)
Update to version 1.74.3: (boo#1267869)
- Bug Fixes
  - rc
    - Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980 (Nick Craig-Wood)
    - Stop global.* connection string options changing config CVE-2026-49980 (Nick Craig-Wood)
  - build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
    - CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
    - CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping
    - CVE-2026-27145: crypto/x509: split…

Record: openSUSE-SU-2026:21436-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21483-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
GO-2026-5933 GHSA-3g4q-2f67-2gvh
GO-2026-5934 GHSA-59qp-cfj3-rp64
GO-2026-5935 GHSA-7856-g3gv-9wq8
GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
GO-2026-5942 CVE-2026-46600
GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
GO-2026-5969 GHSA-g936-7jqj-mwv8
GO-2026-5970 CVE-2026-56852
GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
GO-2026-5981 GHSA-mqxv-9rm6-w8qc
GO-2026-5982 GHSA-pqg7-v6wh-3pfp
GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
GO-2026-5985 GHSA-7rx3-5wx3-5v76
GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…

Record: openSUSE-SU-2026:21483-1
Updated: 2026-11-02

OSVSUSE-SU-2026:1135-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260326T203309 2026-03-26T20:33:09Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-4513 CVE-2026-32284
GO-2026-4514 CVE-2026-32285
GO-2026-4518 CVE-2026-32286
GO-2026-4526 CVE-2026-32287
GO-2026-4700 CVE-2026-32704 GHSA-4j3x-hhg2-fm2x
GO-2026-4701 CVE-2026-32720 GHSA-7x23-j8gv-v54x
GO-2026-4702 CVE-2026-32301 GHSA-j77h-rr39-c552
GO-2026-4703 GHSA-q926-c743-49qj
GO-2026-4704 CVE-2026-32606 GHSA-wj2j-qwcf-cfcc
GO-2026-4705 CVE-2026-32747 GHSA-h5vh-m7fg-w5h6
GO-2026-4706 CVE-2026-32751 GHSA-qr46-rcv3-4hq3
GO-2026-4707 CVE-2026-32749 GHSA-qvvf-q994-x79v
GO-2026-4708 CVE-2026-32750 GHSA-rjhh-m223-9qqv
GO-2026-4709 CVE-2026-32815 GHSA-xp2m-98x8-rpj6
GO-2026-4710 CVE-2026-32760 GHSA-5gg9-5g7w-hm73
GO-2026-4711 CVE-2026-32758 GHSA-9f3r-2vgw-m8xp
GO-2026-4712 CVE-2026-32771 GHSA-f7cq-gvh6-qr25
GO-2026-4713 CVE-2026-32759 GHSA-ffx7-75gc-jg7c
GO-2026-4714 CVE-2026-32737 GHSA-fgm3-q9r5-43v9
GO-2026-4715 CVE-2026-32769 GHSA-hxm7-9q36-c77f
GO-2026-4716 CVE-2026-32767 GHSA-j7wh-x834-p3r7
GO-2026-4717 CVE-2026-32828 GHSA-j94x-8wcp-x7hm
GO-2026-4718 CVE-2026-32768 GHSA-mw24-f3xh-j3qv
GO-2026-4719 CVE-2026-32805 GHSA-p799-g7vv-f279
GO-2026-4721 CVE-2026-32940 GHSA-4mx9-3c2h-hwhg
GO-2026-4722 CVE-2026-32938 GHSA-fq2j-j8hc-8vw8
GO-2026-4723 CVE-2026-32941 GHSA-97vp-pwqj-46qc
GO-2026-4724 CVE-2026-32254 GHSA-phqm-jgc3-qf8g
GO-2026-4725 CVE-2026-25783 GHSA-2v3w-6g35-5f9v
GO-2026-4726 CVE-2026-2456 GHSA-34g8-9fpp-46ch
GO-2026-4727 CVE-2026-26246 GHSA-44mv-jq72-gj49
GO-2026-4728 CVE-2026-32953 GHSA-4w7r-3222-8h6v
GO-2026-4729 CVE-2026-2458 GHSA-679f-wmrg-qf57
GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
GO-2026-4731 CVE-2026-24458 GHSA-m5rv-56xx-hfc6
GO-2026-4732 CVE-2026-2457 GHSA-ph22-fw5m-w2q9
GO-2026-4733 CVE-2026-25780 GHSA-xv2p-wchj-qjhp
GO-2026-4734 CVE-2026-2578 GHSA-3rhr-jr63-hwq5
GO-2026-4735 CVE-2026-2463 GHSA-fx49-m253-27jj
GO-2026-4737 GHSA-594f-3595-c47v
GO-2026-4740 GHSA-h9q6-hc68-35rp
GO-2026-4742 CVE-2026-32811 GHSA-r8x2-fhmf-6mxp
GO-2026-4743 CVE-2026-33066 GHSA-4663-4mpg-879v
GO-2026-4744 CVE-2026-21386 GHSA-5mr9-crcg-8wh2
GO-2026-4745 CVE-2026-24692 GHSA-cwfj-642j-gfh4
GO-2026-4746 CVE-2026-2455 GHSA-gqv7-j2j8-qmwq
GO-2026-4747 CVE-2026-33067 GHSA-mvpm-v6q4-m2pf
GO-2026-4748 CVE-2026-33081 GHSA-qwxp-6qf9-wr4m
GO-2026-4749 CVE-2026-4265 GHSA-xpvf-6qcc-9jqc
GO-2026-4750 CVE-2026-32937 GHSA-6g43-577r-wf4x
GO-2026-4751 CVE-2026-33132 GHSA-g2pf-ww5m-2r9m
GO-2026-4752 CVE-2026-33203 GHSA-3g9h-9hp4-654v
GO-2026-4754 CVE-2026-33063 GHSA-4jrw-92fg-4jwx
GO-2026-4755 CVE-2026-33192 GHSA-5rvc-5cwx-g5x8
GO-2026-4756 CVE-2026-33062 GHSA-7c47-xr7q-p6hg
GO-2026-4757 CVE-2026-33064 GHSA-7g27-v5wj-jr75
GO-2026-4758 CVE-2026-33065 GHSA-958m-gxmc-mccm
GO-2026-4759 CVE-2026-33221 GHSA-g9f6-9775-hffm
GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
GO-2026-4763 CVE-2026-33191 GHSA-p9hg-pq3q-v9gv
GO-2026-4765 GHSA-vccx-p757-pv6h
GO-2026-4766 CVE-2026-33194 GHSA-vm69-h85x-8p85
GO-2026-4768 CVE-2026-33320 GHSA-4fcp-jxh7-23x8
GO-2026-4769 CVE-2026-32691 GHSA-gfgr-6hrj-85ww
GO-2026-4770 GHSA-q382-vc8q-7jhj
GO-2026-4773 CVE-2026-33252 GHSA-89xv-2j6f-qhc8
GO-2026-4774 CVE-2026-30924 GHSA-h8vw-ph9r-xpch
GO-2026-4775 CVE-2026-30836 GHSA-q4r8-xm5f-56gw
GO-2026-4776 CVE-2026-33283 GHSA-3366-gw57-fcm5
GO-2026-4777 CVE-2026-32693 GHSA-439w-v2p7-pggc
GO-2026-4778 CVE-2026-32694 GHSA-5cj2-rqqf-hx9p
GO-2026-4779 CVE-2026-33322 GHSA-5cx5-wh4m-82fh
GO-2026-4780 CVE-2026-33282 GHSA-826q-wrq4-p23x
GO-2026-4781 CVE-2026-32692 GHSA-89x7-5m5m-mcmm
GO-2026-4782 CVE-2026-2461 GHSA-hf8w-x9h5-5gf9
GO-2026-4783 CVE-2026-33281 GHSA-q669-4gmv-g8mf
GO-2026-4784 CVE-2026-2476 GHSA-4ppj-6chv-5pgc
GO-2026-4785 CVE-2026-33344…

Record: SUSE-SU-2026:1135-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`golang.org/x/image` Go	before 0.38.0	0.38.0
`rclone` Alpine:v3.24	before 1.73.5-r0	1.73.5-r0
`golang-golang-x-image` Debian:12	All versions, plus listed versions 0.11.0-10.12.0-10.13.0-10.14.0-10.15.0-1 Show 12 moreShow less 0.16.0-10.18.0-10.32.0-10.35.0-10.38.0-10.39.0-10.42.0-10.45.0-10.5.0-10.7.0-10.8.0-10.9.0-1	None known
`golang-golang-x-image` Debian:13	All versions, plus listed versions 0.18.0-10.32.0-10.35.0-10.38.0-10.39.0-10.42.0-10.45.0-1	None known
`golang-golang-x-image` Debian:14	before 0.38.0-1, plus listed versions 0.18.0-10.32.0-10.35.0-1	0.38.0-1
`golang1.26` Red Hat:hummingbird:1	before 0:1.26.2-1.hum1	0:1.26.2-1.hum1
`golang1.26-bin` Red Hat:hummingbird:1	before 0:1.26.2-1.hum1	0:1.26.2-1.hum1
`golang1.26-docs` Red Hat:hummingbird:1	before 0:1.26.2-1.hum1	0:1.26.2-1.hum1
`golang1.26-misc` Red Hat:hummingbird:1	before 0:1.26.2-1.hum1	0:1.26.2-1.hum1
`golang1.26-shared` Red Hat:hummingbird:1	before 0:1.26.2-1.hum1	0:1.26.2-1.hum1

Show 23 moreShow less

Affected packages
Package	Affected	Fixed
`golang1.26-src` Red Hat:hummingbird:1	before 0:1.26.2-1.hum1	0:1.26.2-1.hum1
`golang1.26-tests` Red Hat:hummingbird:1	before 0:1.26.2-1.hum1	0:1.26.2-1.hum1
`golang1.25` Red Hat:hummingbird:1	before 0:1.25.9-1.hum1	0:1.25.9-1.hum1
`golang1.25-bin` Red Hat:hummingbird:1	before 0:1.25.9-1.hum1	0:1.25.9-1.hum1
`golang1.25-docs` Red Hat:hummingbird:1	before 0:1.25.9-1.hum1	0:1.25.9-1.hum1
`golang1.25-misc` Red Hat:hummingbird:1	before 0:1.25.9-1.hum1	0:1.25.9-1.hum1
`golang1.25-shared` Red Hat:hummingbird:1	before 0:1.25.9-1.hum1	0:1.25.9-1.hum1
`golang1.25-src` Red Hat:hummingbird:1	before 0:1.25.9-1.hum1	0:1.25.9-1.hum1
`golang1.25-tests` Red Hat:hummingbird:1	before 0:1.25.9-1.hum1	0:1.25.9-1.hum1
`govulncheck-vulndb` openSUSE:Leap 15.6	before 0.0.20260326T203309-150000.1.155.2	0.0.20260326T203309-150000.1.155.2
`golang-golang-x-image` Ubuntu:18.04:LTS	All versions, plus listed versions 0.0~git20170523.0.426cfd8-1	None known
`golang-golang-x-image` Ubuntu:20.04:LTS	All versions, plus listed versions 0.0~git20190703.d6a02ce-10.0~git20200119.58c2397-1	None known
`golang-golang-x-image` Ubuntu:22.04:LTS	All versions, plus listed versions 0.0~git20200119.58c2397-10.0~git20210628.a66eb64-10.0~git20211028.6944b10-1	None known
`golang-golang-x-image` Ubuntu:24.04:LTS	All versions, plus listed versions 0.7.0-10.13.0-10.14.0-10.15.0-1	None known
`golang-golang-x-image` Ubuntu:25.10	All versions, plus listed versions 0.18.0-1	None known
`golang-golang-x-image` Ubuntu:26.10	All versions, plus listed versions 0.35.0-10.39.0-10.42.0-10.45.0-1	None known
`golang-golang-x-image` Ubuntu:26.04:LTS	All versions, plus listed versions 0.18.0-10.32.0-10.35.0-1	None known
`pocketbase` openSUSE:Tumbleweed	before 0.37.3-1.1	0.37.3-1.1
`rclone` openSUSE:Tumbleweed	before 1.74.2-1.1	1.74.2-1.1
`gomuks` openSUSE:Tumbleweed	before 26.03+git.1780250926.564a8707-1.1	26.03+git.1780250926.564a8707-1.1
`neonmodem` openSUSE:Leap 16.0	before 1.0.7+git0.346d1d3-bp160.1.1	1.0.7+git0.346d1d3-bp160.1.1
`rclone` openSUSE:Leap 16.0	before 1.74.4-bp160.1.1	1.74.4-bp160.1.1
`govulncheck-vulndb` openSUSE:Leap 16.0	before 0.0.20260723T184607-160000.1.1	0.0.20260723T184607-160000.1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33809 is a medium vulnerability (CVSS 5.3) in Golang Tiff, published March 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in golang.org/x/image 0.38.0.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 1,871 references and the rest of 3 source descriptions. The JSON record has them.