Panic when reading out of bound palette index in golang.org/x/image/bmp

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-42500 · CVE overview and exploitation status

EUVD-2026-33419

GHSA-m6fh-wvw4-4629

GO-2026-5031

cve-program · CVE-2026-42500

• https://go.dev/issue/79576
• https://groups.google.com/g/golang-announce/c/uhYX90BlBvI
• https://go.dev/cl/781500
• https://pkg.go.dev/vuln/GO-2026-5031

euvd · EUVD-2026-33419

• https://go.dev/issue/79576
• https://groups.google.com/g/golang-announce/c/uhYX90BlBvI
• https://go.dev/cl/781500
• https://pkg.go.dev/vuln/GO-2026-5031

nvd · CVE-2026-42500

• https://go.dev/cl/781500
• https://go.dev/issue/79576
• https://groups.google.com/g/golang-announce/c/uhYX90BlBvI
• https://pkg.go.dev/vuln/GO-2026-5031

osv · GO-2026-5031

• https://go.dev/issue/79576
• https://groups.google.com/g/golang-announce/c/uhYX90BlBvI
• https://go.dev/cl/781500

No related changes are available here.