Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image

概要

参考情報

• go.dev/cl/787681 · FIX
• go.dev/issue/79869 · REPORT
• pkg.go.dev/vuln/GO-2026-5061

golang.org/x/image のその他の脆弱性

• CVE-2026-46603高 7.5VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unu…
• CVE-2026-46604高 7.5The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.
• CVE-2026-46602高 7.5The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large …
• CVE-2026-46599高 7.5The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a sma…
• CVE-2026-42500中 5.3Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.