{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46601", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-05-15T17:35:00.814Z", "datePublished": "2026-06-25T19:47:21.500Z", "dateUpdated": "2026-06-25T19:47:21.500Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-06-25T19:47:21.500Z"}, "title": "Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image", "descriptions": [{"lang": "en", "value": "The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size."}], "affected": [{"vendor": "golang.org/x/image", "product": "golang.org/x/image/webp", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/image/webp", "versions": [{"version": "0", "lessThan": "0.43.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "decode"}, {"name": "Decode"}, {"name": "DecodeConfig"}], "defaultStatus": "unaffected"}, {"vendor": "golang.org/x/image", "product": "golang.org/x/image/webp", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/image/webp", "versions": [{"version": "0", "lessThan": "0.43.0", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125: Out-of-bounds Read"}]}], "references": [{"url": "https://go.dev/cl/787681"}, {"url": "https://go.dev/issue/79869"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5061"}], "credits": [{"lang": "en", "value": "Lucas Futures (GitHub: gn00295120)"}]}}}

{}

{}

{}

{"created": "2026-06-25T22:15:04.737877+00:00", "updated": "2026-06-25T22:15:04.737890+00:00", "vendors": [], "weaknesses": ["CWE-20"]}