The CVE-2026-46603 vulnerability affects the VP8L decoding in golang.org/x/image/vp8l, allowing remote attackers to cause a denial of service via memory exhaustion. This is achieved by processing a crafted VP8L image containing many unused Huffman tree groups, leading to excessive memory allocation. The vulnerability has a high severity score of 7.5 and is classified as HIGH. Organizations and developers [truncated]
A vulnerability in the Go standard library's TIFF decoder allows maliciously-crafted images to trigger excessive memory consumption. The PackBits decompression routine lacks bounds checking on compressed data size, enabling a small input image to expand into arbitrarily large decompressed output. This represents a denial-of-service vector through resource exhaustion. The issue was addressed in Go's securi [truncated]
## Summary A vulnerability in Go's image processing library causes a panic when decoding malformed paletted BMP files with out-of-range palette indices. This denial-of-service condition affects applications that process untrusted BMP images. ## Technical Details The vulnerability exists in Go's BMP decoder when handling paletted (8-bit) BMP files. A malformed file containing palette indices that exceed th [truncated]
