{"id":"EUVD-2026-39550","enisaUuid":"1a86065d-81d1-3138-942e-dfd60f63021b","description":"The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.","datePublished":"Jun 25, 2026, 7:47:21 PM","dateUpdated":"Jun 26, 2026, 4:09:18 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://go.dev/cl/787681\nhttps://go.dev/issue/79869\nhttps://pkg.go.dev/vuln/GO-2026-5061\n","aliases":"CVE-2026-46601\nGHSA-m43h-mp45-ghq6\n","assigner":"Go","epss":0.61,"enisaIdProduct":[{"id":"6e05cda0-db1e-3ac5-925f-f0f594bf47ce","product":{"name":"golang.org/x/image/webp","vendor":{"name":"golang.org/x/image"}},"product_version":"0 \u003c0.43.0"}],"enisaIdVendor":[{"id":"4ece145f-7a1f-37cf-a1d3-314e2055d622","vendor":{"name":"golang.org/x/image"}}],"enisaIdVulnerability":[{"id":"047309c0-03b5-30ce-9040-4a88c22f2033","vulnerability":{"id":"CVE-2026-46601","description":"The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.","datePublished":"Jun 25, 2026, 7:47:21 PM","dateUpdated":"Jun 26, 2026, 4:09:18 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://go.dev/cl/787681\nhttps://go.dev/issue/79869\nhttps://pkg.go.dev/vuln/GO-2026-5061\n","enisa_id":"EUVD-2026-39550\n","assigner":"Go","epss":0.61,"dataProcessed":"Nov 7, 2026, 7:22:17 AM","vulnerabilityProduct":[{"id":"d3c83eb0-32a4-3fae-933c-73d56da40774","product":{"name":"golang.org/x/image/webp","vendor":{"name":"golang.org/x/image"}},"product_version":"0 \u003c0.43.0"}],"vulnerabilityVendor":[{"id":"8070e25c-39e5-32b3-bcb8-d76704392ea2","vendor":{"name":"golang.org/x/image"}}]}},{"id":"78152305-8d71-3530-b0d8-b82403b75001","vulnerability":{"id":"GHSA-m43h-mp45-ghq6","description":"The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.","datePublished":"Jun 25, 2026, 9:31:31 PM","dateUpdated":"Jun 26, 2026, 6:33:50 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-46601\nhttps://go.dev/cl/787681\nhttps://go.dev/issue/79869\nhttps://pkg.go.dev/vuln/GO-2026-5061\n","enisa_id":"EUVD-2026-39550\n","aliases":"GHSA-m43h-mp45-ghq6\nCVE-2026-46601\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}