CVE-2026-46604

HighCVSS 7.5/10Last modified Jul 1, 2026

Description

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2026
Last modified
Jul 1, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-466054.3Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing deCVE-2026-466067.8Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vmsCVE-2026-466077.8Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-chCVE-2026-466087.4Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configCVE-2026-466094.6Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, whCVE-2026-46617.5The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the CVE-2026-466115.3Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glanCVE-2026-466128.8Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-466149.8Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-466166.1Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member relateCVE-2026-466178.7Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-466186.9Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes
CVE-2026-46604: High severity, CVSS 7.5 | Vulnix