GO-2026-4961

Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image

At a glance

Published: 2026-04-21 18:59 UTC
Updated: 2026-06-25 18:45 UTC
CVE: CVE-2026-33813

Description

Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.

Affected packages

Package	Versions
Go · golang.org/x/image	introduced 0, fixed 0.42.0

References

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database