CVE-2026-33813 Parsing a WEBP image with an invalid, large size panics on 32-bit platforms

Description

Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.

Affected products and versions

Product	Affected versions	Fixed in
golang.org/x/image/webp 0.42	earliest → < 0.42.0	0.42.0

Other CVEs of golang.org/x/image/webp

The 2 CVEs of golang.org/x/image/webp →

CVE-2026-46601 The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size 7.5 High