Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-46601

Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

golang.org/x/image golang.org/x/image/webp

Default version status: unaffected

  • 0 to < 0.43.0affected

golang.org/x/image golang.org/x/image/webp

Default version status: unaffected

  • 0 to < 0.43.0affected

References