CVE-2026-46601: Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
Published Jun 25, 2026
·Updated
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
Affected Software
1 affected component
golang.org/x/image/webp
Event History
Jun 25, 2026
CVE Published
via MITRE·07:47 PM
Data Sourced
via MITRE·07:47 PM
DescriptionWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2026-46601?
CVE-2026-46601 has a severity score of 7.5, categorized as high risk.
2
How do I fix CVE-2026-46601?
To fix CVE-2026-46601, update to the latest version of golang.org/x/image/webp that addresses the vulnerability.
3
What impact does CVE-2026-46601 have on my application?
CVE-2026-46601 may lead to a panic in your application when processing malformed VP8 chunks, potentially causing crashes.
4
What versions of golang.org/x/image/webp are affected by CVE-2026-46601?
CVE-2026-46601 affects versions of golang.org/x/image/webp prior to the patch release that resolves the issue.
5
How can I determine if my application is vulnerable to CVE-2026-46601?
To determine if your application is vulnerable to CVE-2026-46601, check if it utilizes the affected x/image/webp package with unpatched versions.