CVE-2026-46603
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.
Risk Assessment
The risk for the organization is the possibility of remote denial of service (DoS) via memory exhaustion, potentially leading to unavailability of applications using this library.
Recommendation
It is recommended to update the golang.org/x/image library to a patched version and review code for processing untrusted VP8L images.
Original NVD description (English source)
VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.