Threats affecting pkg:golang/golang.org/x/image/bmp

CVE-2026-42500 is a medium severity vulnerability in the golang.org/x/image/bmp package where decoding a paletted BMP file with an out-of-range palette index causes a panic due to improper validation of the array index. This results in a denial of service condition by crashing the image decoding process. There is no indication of confidentiality, integrity, or privilege impact. No patch or official remediation has been confirmed yet.