CVE-2026-46601 - Vulnerability Details - OpenCVE

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Golang	Image

No data.

No data.

References

Link	Providers
https://go.dev/cl/787681
https://go.dev/issue/79869
https://pkg.go.dev/vuln/GO-2026-5061

History

Fri, 26 Jun 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Fri, 26 Jun 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20

Fri, 26 Jun 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 26 Jun 2026 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Golang Golang image
Vendors & Products		Golang Golang image

Thu, 25 Jun 2026 22:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Thu, 25 Jun 2026 20:00:00 +0000

Type	Values Removed	Values Added
Description		The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
Title		Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
References		https://go.dev/cl/787681 https://go.dev/issue/79869 https://pkg.go.dev/vuln/GO-2026-5061

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2026-06-25T19:47:21.500Z

Updated: 2026-06-26T16:09:18.573Z

Reserved: 2026-05-15T17:35:00.814Z

Link: CVE-2026-46601

Vulnrichment

Updated: 2026-06-26T16:09:13.233Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46601", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-05-15T17:35:00.814Z", "datePublished": "2026-06-25T19:47:21.500Z", "dateUpdated": "2026-06-26T16:09:18.573Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-06-25T19:47:21.500Z"}, "title": "Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image", "descriptions": [{"lang": "en", "value": "The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size."}], "affected": [{"vendor": "golang.org/x/image", "product": "golang.org/x/image/webp", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/image/webp", "versions": [{"version": "0", "lessThan": "0.43.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "decode"}, {"name": "Decode"}, {"name": "DecodeConfig"}], "defaultStatus": "unaffected"}, {"vendor": "golang.org/x/image", "product": "golang.org/x/image/webp", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/image/webp", "versions": [{"version": "0", "lessThan": "0.43.0", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125: Out-of-bounds Read"}]}], "references": [{"url": "https://go.dev/cl/787681"}, {"url": "https://go.dev/issue/79869"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5061"}], "credits": [{"lang": "en", "value": "Lucas Futures (GitHub: gn00295120)"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T16:08:56.631719Z", "id": "CVE-2026-46601", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T16:09:18.573Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-46601", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T16:08:56.631719Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T16:09:13.233Z"}}], "cna": {"title": "Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image", "credits": [{"lang": "en", "value": "Lucas Futures (GitHub: gn00295120)"}], "affected": [{"vendor": "golang.org/x/image", "product": "golang.org/x/image/webp", "versions": [{"status": "affected", "version": "0", "lessThan": "0.43.0", "versionType": "semver"}], "packageName": "golang.org/x/image/webp", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "decode"}, {"name": "Decode"}, {"name": "DecodeConfig"}]}, {"vendor": "golang.org/x/image", "product": "golang.org/x/image/webp", "versions": [{"status": "affected", "version": "0", "lessThan": "0.43.0", "versionType": "semver"}], "packageName": "golang.org/x/image/webp", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected"}], "references": [{"url": "https://go.dev/cl/787681"}, {"url": "https://go.dev/issue/79869"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5061"}], "descriptions": [{"lang": "en", "value": "The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-06-25T19:47:21.500Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46601", "state": "PUBLISHED", "dateUpdated": "2026-06-26T16:09:18.573Z", "dateReserved": "2026-05-15T17:35:00.814Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-06-25T19:47:21.500Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}