Golang golang x image: The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. (CVE-2026-46601)

The golang x image package's webp decoder contains a flaw where it panics if it encounters a VP8 chunk with dimensions that differ from the expected canvas size. This can lead to an application crash, impacting availability but not confidentiality or integrity. The vulnerability is identified as CVE-2026-46601 and affects specific versions of the golang-golang-x-image package, including versions 0.7.0-1, 0.13.0-1, 0.14.0-1, 0.15.0-1, 0.18.0-1, 0.32.0-1, 0.35.0-1, 0.39.0-1, 0.42.0-1, and 0.45.0-1. No known exploits in the wild have been reported, and no patch or remediation information is provided in the source data.

Successful exploitation causes the webp decoder to panic, resulting in a denial of service condition by crashing the application using the vulnerable library. There is no impact on confidentiality or integrity. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider avoiding processing untrusted webp images or implementing application-level safeguards to handle decoder panics gracefully.