CVE-2026-46601: Golang.org/x/image Golang.org/x/image/webp

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.

Affected products

• Golang.org/x/image Golang.org/x/image/webp: before 0.43.0 (fixed in 0.43.0)

Published 2026-06-25. Last modified 2026-06-26.