Is CVE-2026-33813 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33813 being exploited in the wild.

How severe is CVE-2026-33813?

High severity, with a CVSS score of 7.5, published 21 April 2026.

Which products and versions are affected?

golang.org/x/image (Go) SEMVER:introduced=0,fixed=0.42.0; Google Webp < 0.39.0.

Is there a fix for CVE-2026-33813?

Yes. golang.org/x/image (Go): upgrade to 0.42.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33813 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33813?

Check whether you run golang.org/x/image (Go), image (Go) or Google Webp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33813: Go x/image/webp denial of service on 32-bit platforms

Q: Is there a fix for CVE-2026-33813?

Yes. golang.org/x/image (Go): upgrade to 0.42.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33813 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-33813?

Check whether you run golang.org/x/image (Go), image (Go) or Google Webp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33813 · Severity: high · CVSS 7.5 · Published 2026-04-21

A vulnerability in the Go programming language's WebP image processing library can cause applications to crash when processing specially crafted image files. This issue specifically affects systems running on 32-bit architectures. An attacker could exploit this to cause a denial-of-service, potentially disrupting business operations or services that allow users to upload or view images.

Technologies: golang.org/x/image (Go). Vendors: Go, Google.

Quick answers

Is CVE-2026-33813 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33813 being exploited in the wild.
How severe is CVE-2026-33813?: High severity, with a CVSS score of 7.5, published 21 April 2026.
Which products and versions are affected?: golang.org/x/image (Go) SEMVER:introduced=0,fixed=0.42.0; Google Webp < 0.39.0.
Is there a fix for CVE-2026-33813?: Yes. golang.org/x/image (Go): upgrade to 0.42.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33813 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33813?: Check whether you run golang.org/x/image (Go), image (Go) or Google Webp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/image (Go): upgrade to 0.42.0 or later
```
go get golang.org/x/image@v0.42.0
```

Technical details

A denial-of-service vulnerability exists in the golang.org/x/image/webp package due to insufficient validation of canvas sizes in WebP VP8X headers. On 32-bit platforms, parsing a WebP image with a canvas size that overflows a 32-bit integer results in the creation of a corrupt image object. Subsequent access to this corrupt object triggers a runtime panic. The issue is reachable via the Decode and DecodeConfig functions. This vulnerability was addressed in version 0.42.0 of the golang.org/x/image library by implementing proper maximum size checks.

Affected products

Go Project golang.org/x/image/webp < 0.42.0

Identifiers

CVE-2026-33813
GO-2026-4961

Timeline

2026-03-27: disclosed: Issue reported to Go project by Tristan Madani
2026-04-21: advisory: CVE-2026-33813 published
2026-06-25: patched: Updated version 0.42.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.