CVE-2026-46601

HighCVSS 7.5/10Last modified Oct 25, 2026

Description

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
golang.org/x/imagegolang.org/x/image/webp< 0.43.0
golang.org/x/imagegolang.org/x/image/webp< 0.43.0

References

Timeline

Published
Jun 25, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-466027.5The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large CVE-2026-466037.5VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unuCVE-2026-466047.5The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.CVE-2026-466054.3Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing deCVE-2026-466067.8Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vmsCVE-2026-466077.8Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-chCVE-2026-466087.4Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configCVE-2026-466094.6Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, whCVE-2026-46617.5The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the CVE-2026-466115.3Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glanCVE-2026-466128.8Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-466149.8Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes
CVE-2026-46601: High severity, CVSS 7.5 | Vulnix