← CVE Intelligence

CVE-2026-46601

Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image PUBLISHED

Description (CNA)

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.

Affected (CNA)

Vendor / productVersions
golang.org/x/image / golang.org/x/image/webpaffected 0 before 0.43.0
golang.org/x/image / golang.org/x/image/webpaffected 0 before 0.43.0

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.