EUVD-2026-39550
GHSA-m43h-mp45-ghq6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Untrusted WebP reaches the decoder remotely with no auth or interaction (AV:N/AC:L/PR:N/UI:N); a panic causes availability loss only (A:H, C:N/I:N).
Primary rating from Vendor (Go).
CVSS VectorVendor: Go
Lifecycle Timeline
4DescriptionCVE.org
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
AnalysisAI
Denial of service in the golang.org/x/image/webp decoder (versions before 0.43.0) allows remote attackers to crash any Go application that decodes attacker-supplied WebP images. A malformed VP8 chunk whose declared dimensions differ from the canvas size triggers an unrecovered panic, aborting the goroutine or process. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and SSVC lists exploitation as none, but the flaw is trivially reachable and automatable wherever untrusted images are processed.
Technical ContextAI
The affected component is the pure-Go WebP image decoder in the golang.org/x/image supplementary library, widely vendored into Go services that accept or transcode images. WebP files carry image data in RIFF chunks; a lossy 'VP8 ' chunk encodes a VP8 keyframe whose intrinsic width/height must be reconciled with the overall canvas dimensions declared in the container. The decoder fails to safely handle the case where the VP8 chunk dimensions do not match the canvas size, leading to an out-of-range/inconsistent-state condition that manifests as a Go runtime panic. Although no CWE was assigned in the input, this is characteristically a reachable assertion/bounds panic on untrusted input (CWE-248 Uncaught Exception / CWE-20 Improper Input Validation class), producing a crash rather than memory corruption because Go's runtime bounds-checks rather than allowing overflow.
RemediationAI
Vendor-released patch: upgrade golang.org/x/image to version 0.43.0 or later (run 'go get golang.org/x/image@v0.43.0' and rebuild), which is the primary and complete fix per the Go issue https://go.dev/issue/79869 and change https://go.dev/cl/787681; see GO-2026-5061 (https://pkg.go.dev/vuln/GO-2026-5061) for tracking. Use 'govulncheck' to confirm no remaining callable paths to the vulnerable symbol. Where an immediate dependency bump is not possible, apply compensating controls at the application boundary: recover from panics in the goroutine that performs image decoding (wrap the webp.Decode call in a deferred recover so a crafted image degrades to a handled error instead of a process/goroutine abort) - the trade-off is that this masks the underlying bug and can hide other decode failures; alternatively, validate or transcode uploads through a hardened out-of-process image pipeline, or reject/limit WebP uploads entirely at the ingress layer - the trade-off being lost WebP functionality for users. These are stopgaps only; the version upgrade should follow promptly.
More in Golang Org X Image Webp
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today