The golang.org/x/image/webp decoder has a vulnerability classified as CWE-125 (Out-of-bounds Read). Specifically, when processing a VP8 chunk with dimensions that differ from the expected canvas size, the decoder can panic due to accessing memory outside the intended bounds. This issue affects versions of golang.org/x/image/webp prior to 0.43.0. No CVSS score or detailed vendor remediation information is currently available.

This vulnerability can cause the application using the vulnerable webp decoder to panic and crash when decoding specially crafted webp images with mismatched VP8 chunk dimensions. There is no evidence of code execution or data corruption beyond the denial of service caused by the panic. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor golang.org/x/image project updates for an official fix. Until a patch is available, avoid processing untrusted webp images or implement application-level safeguards to handle decoder panics gracefully.