CVE-2026-42500
Description
A flaw was found in golang.org/x/image/bmp. A remote attacker could exploit this vulnerability by providing a specially crafted paletted BMP (Bitmap) file. Decoding this file with an out-of-range palette index causes the application to panic when accessing invalid image pixels, leading to a Denial of Service (DoS). This could make the affected application unavailable to legitimate users.
Statement
A flaw was found in golang.org/x/image/bmp. Decoding a specially crafted paletted BMP file with an out-of-range palette index causes an unrecoverable panic, resulting in denial of service. The vulnerable code is registered automatically via init() when the bmp package is imported. Versions of golang.org/x/image prior to v0.40.0 are affected.
Mitigation
No mitigation is available for this vulnerability.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
