CVE-2026-46604: 
Tailscale vulnerability analysis and mitigation

CVE-2026-46604 is a Denial of Service vulnerability in the Go TIFF decoder (golang.org/x/image/tiff) that causes a panic when decoding an invalid TIFF image containing an out-of-bounds strip offset. It was published on June 26, 2026, and affects all versions of golang.org/x/image prior to 0.43.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), exploitable remotely without authentication or user interaction (Go Vuln DB, OSV).

The root cause is classified as CWE-787 (Out-of-bounds Write), triggered when the TIFF decoder processes a maliciously crafted image whose strip offset value falls outside the valid bounds of the underlying data buffer. When such an image is submitted for decoding, the Go runtime panics, crashing the application or service hosting the decoder. No authentication or special privileges are required — an attacker only needs to supply a malformed TIFF file to a network-accessible endpoint that invokes the vulnerable decoder. The issue is tracked upstream at go.dev/issue/80122 and fixed via changelist go.dev/cl/788421.

Successful exploitation results in a runtime panic in the Go process handling the TIFF image, causing a Denial of Service (DoS) by crashing the affected service or application. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Any application or service that accepts and decodes TIFF images using golang.org/x/image/tiff (e.g., image processing pipelines, file upload handlers, cloud storage tools like rclone) is at risk of service disruption (Go Vuln DB).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The NVD SSVC assessment confirms exploitation status as "none" and technical impact as "partial," though the attack is rated as automatable due to its network-accessible, no-authentication-required nature. The EPSS score is approximately 0.169%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate a network-accessible service or application that accepts TIFF image uploads or processes TIFF files using the golang.org/x/image/tiff package (versions < 0.43.0), such as image processing APIs or file storage services.
2. Craft malformed TIFF: Create an invalid TIFF file with a strip offset value set to a value exceeding the bounds of the image data (e.g., an offset pointing beyond the end of the file or data buffer).
3. Submit the image: Upload or send the crafted TIFF file to the target endpoint (e.g., via HTTP POST to an image upload API, or by placing it in a monitored directory).
4. Trigger panic: The vulnerable TIFF decoder processes the file, encounters the out-of-bounds strip offset, and triggers a Go runtime panic, crashing the service and causing a Denial of Service (Go Issue).

• Logs: Unexpected Go runtime panic messages in application logs, such as panic: runtime error: index out of range or similar, associated with TIFF decoding operations.
• Network: Repeated submission of TIFF files (especially small or malformed ones) to image-processing endpoints from the same or rotating source IPs.
• Process: Sudden termination or restart of Go-based services that handle image processing, particularly those invoking golang.org/x/image/tiff.
• File System: Presence of unusually structured or minimal TIFF files in upload directories or temporary processing folders.

The fix is available in golang.org/x/image version 0.43.0 — all users should upgrade to this version or later (Go Vuln DB, go.dev/cl/788421). As interim workarounds, operators should implement input validation to verify TIFF strip offsets are within valid bounds before passing images to the decoder, and consider sandboxing or isolating TIFF decoding processes to limit the blast radius of a panic. OpenSUSE and other Linux distributions have also issued security updates addressing this CVE (openSUSE Advisory).

The vulnerability received routine coverage from vulnerability aggregators and scanner vendors (Tenable/Nessus, Qualys) shortly after disclosure. OpenSUSE issued security advisories addressing the issue for its distributions. The rclone project, which depends on golang.org/x/image, noted the fix in its changelog. No significant researcher commentary or broader media coverage has been observed, consistent with the limited exploitation risk.