The vulnerability CVE-2026-42500 in golang.org/x/image/bmp involves improper validation of array indices (CWE-129) when decoding paletted BMP files. Specifically, if a BMP file contains a palette index that is out-of-range, the decoder attempts to access an invalid pixel index, causing a runtime panic. This leads to an application crash or denial of service during image decoding. The CVSS score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service). No patch or remediation level has been provided by the vendor at this time.

The impact is limited to availability, causing a denial of service by crashing the image decoding process when processing specially crafted BMP files with invalid palette indices. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider validating or sanitizing BMP files before decoding to avoid triggering the panic. No official fix or workaround has been documented by the vendor.