Executive brief
A vulnerability in the Go programming language's WebP image processing library can cause applications to crash when processing specially crafted image files. This issue specifically affects systems running on 32-bit architectures. An attacker could exploit this to cause a denial-of-service, potentially disrupting business operations or services that allow users to upload or view images.
Technical details
A denial-of-service vulnerability exists in the golang.org/x/image/webp package due to insufficient validation of canvas sizes in WebP VP8X headers. On 32-bit platforms, parsing a WebP image with a canvas size that overflows a 32-bit integer results in the creation of a corrupt image object. Subsequent access to this corrupt object triggers a runtime panic. The issue is reachable via the Decode and DecodeConfig functions. This vulnerability was addressed in version 0.42.0 of the golang.org/x/image library by implementing proper maximum size checks.
Affected products
- Go Project golang.org/x/image/webp < 0.42.0
Timeline
- 2026-03-27: disclosed: Issue reported to Go project by Tristan Madani
- 2026-04-21: advisory: CVE-2026-33813 published
- 2026-06-25: patched: Updated version 0.42.0 released