CVE-2026-46603 describes a memory allocation issue in the golang.org/x/image/vp8l package. When decoding a specially crafted VP8L image containing numerous unused Huffman tree groups, the decoder may allocate an excessive amount of memory. This flaw can be exploited remotely by an attacker to cause a denial of service condition through memory exhaustion. The vulnerability is classified under CWE-789 (Memory Allocation with Excessive Size Value). Affected versions are those prior to 0.45.0 of golang.org/x/image. There is no CVSS score or vendor advisory indicating a patch or remediation status at this time.

An attacker can cause a denial of service by supplying a malicious VP8L image that triggers excessive memory allocation during decoding. This can exhaust system memory resources, potentially crashing or severely degrading the availability of applications using the vulnerable library.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted VP8L images or implement resource limits on memory usage during image decoding to mitigate potential denial of service.