CVE-2026-46601 Details
Description
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
A panic vulnerability has been identified in the WebP decoder of the Golang x/image package, prior to version 0.43.0. This issue arises when processing a VP8 chunk whose dimensions do not align with the canvas size. The mismatch can lead to the construction of an image.NYCbCrA object with inconsistent YBcCr and alpha data, causing a panic when out-of-bounds alpha channel data is accessed.
Users can update to Golang x/image version 0.43.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://go.dev/cl/787681 | [email protected] | Source CodeVendor |
| https://go.dev/issue/79869 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://pkg.go.dev/vuln/GO-2026-5061 | [email protected] | AdvisoryVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| golang.org/x/image/webp | < v0.43.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |