Executive brief
A vulnerability exists in the Go programming language's image processing library, specifically when handling BMP image files. An attacker can provide a specially crafted image file that causes the application to crash (panic) when it attempts to read the image data. This can lead to a denial-of-service, potentially disrupting services that process user-uploaded images.
Technical details
A denial-of-service vulnerability exists in the golang.org/x/image/bmp package. The issue is caused by a lack of bounds checking when decoding paletted BMP files; specifically, an out-of-range palette index triggers a runtime panic when the application attempts to access pixels in the resulting invalid image object. This can be exploited by a remote, unauthenticated attacker who provides a malformed BMP file to an application using the affected library's Decode function. The vulnerability is addressed in version v0.41.0 of the golang.org/x/image package.
Affected products
- Go Project golang.org/x/image/bmp before v0.41.0
Timeline
- 2026-05-21: disclosed: Issue reported on GitHub
- 2026-05-29: advisory: CVE published and Go vulnerability report released