Threat database

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.

CVE-2026-42500 is a medium severity vulnerability in the golang.org/x/image/bmp package where decoding a paletted BMP file with an out-of-range palette index causes a panic due to improper validation of the array index. This results in a denial of service condition by crashing the image decoding process. There is no indication of confidentiality, integrity, or privilege impact. No patch or official remediation has been confirmed yet.

Parsing a malicious font file can cause excessive memory allocation.

Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.