{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33813", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-03-23T20:35:32.814Z", "datePublished": "2026-04-21T19:21:27.644Z", "dateUpdated": "2026-04-21T19:21:27.644Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-04-21T19:21:27.644Z"}, "title": "Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image", "descriptions": [{"lang": "en", "value": "Parsing a WEBP image with an invalid, large size panics on 32-bit platforms."}], "affected": [{"vendor": "golang.org/x/image", "product": "golang.org/x/image/webp", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/image/webp", "versions": [{"version": "0", "lessThan": "0.39.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "decode"}, {"name": "Decode"}, {"name": "DecodeConfig"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "references": [{"url": "https://go.dev/cl/759860"}, {"url": "https://go.dev/issue/78407"}, {"url": "https://pkg.go.dev/vuln/GO-2026-4961"}], "credits": [{"lang": "en", "value": "Tristan Madani"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Parsing a WEBP image with an invalid, large size panics on 32-bit platforms."}], "id": "CVE-2026-33813", "lastModified": "2026-04-21T20:16:56.387", "metrics": {}, "published": "2026-04-21T20:16:56.387", "references": [{"source": "security@golang.org", "url": "https://go.dev/cl/759860"}, {"source": "security@golang.org", "url": "https://go.dev/issue/78407"}, {"source": "security@golang.org", "url": "https://pkg.go.dev/vuln/GO-2026-4961"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.39.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "golang.org/x/image/webp", "source": "cna", "vendor": "golang.org/x/image"}, "product": "image", "vendor": "golang"}], "analysis": {"en": {"generated_at": "2026-04-22T05:29:40.769278+00:00", "value": {"mitigation_remediation": ["Upgrade golang.org/x/image/webp to a patched version.", "Validate WebP images before decoding to reject oversized files.", "Run the application on a 64\u2011bit platform or isolate 32\u2011bit execution to prevent the overflow from causing a crash."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "All versions of the golang.org/x/image/webp package used in Go applications on 32\u2011bit operating systems are affected. The vulnerability is tied to the WebP decoding code and is present until the library is updated with the fix described in the referenced Go issue.", "description_and_impact": "A WebP image decoder in golang.org/x/image/webp panics when parsing an image with an invalid, very large size on 32\u2011bit platforms. The panic occurs due to improper handling of the size value during parsing, causing the application to terminate. This failure to validate input leads to a denial of service because the application crashes when encountering the malformed image.", "risk_and_exploitability": "The exploit requires an attacker to supply a crafted WebP file with an oversized size field. On 32\u2011bit systems, the decoder will panic and terminate the process. No public exploit is listed and the EPSS score is not available, but the impact is a local or remote denial of service if the application accepts external images. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the issue from any environment that feeds WebP data to the decoder, making the risk moderate to high for exposed services."}}}}, "created": "2026-04-22T05:30:09.560991+00:00", "updated": "2026-04-22T11:45:35.967336+00:00", "vendors": ["golang", "golang$PRODUCT$image"], "weaknesses": ["CWE-680"]}