CVE-2026-46601 is an out-of-bounds read vulnerability (CWE-125) in the golang.org/x/image/webp package. Specifically, the webp decoder panics when it encounters a VP8 chunk with dimensions that do not align with the expected canvas size. This can lead to a denial of service condition by crashing the application using the vulnerable decoder. The vulnerability affects all versions before 0.43.0. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Successful exploitation causes the webp decoder to panic, resulting in a denial of service (application crash). There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor golang.org/x/image project updates for an official fix addressing this vulnerability. Until a patch is available, consider implementing input validation or sandboxing to mitigate potential denial of service from malformed webp images.