7.5
High
CVE-2026-46601 The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size
Description
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| golang.org/x/image/webp 0.43 | earliest → < 0.43.0 | 0.43.0 |