{"schema_version":"1.3.1","id":"GO-2026-4961","modified":"2026-06-18T22:34:50Z","published":"2026-04-21T18:59:43Z","aliases":["CVE-2026-33813"],"summary":"Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image","details":"Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.","affected":[{"package":{"name":"golang.org/x/image","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.42.0"}]}],"ecosystem_specific":{"imports":[{"path":"golang.org/x/image/webp","symbols":["Decode","DecodeConfig","decode"]}]}}],"references":[{"type":"FIX","url":"https://go.dev/cl/759860"},{"type":"FIX","url":"https://go.dev/cl/780860"},{"type":"REPORT","url":"https://go.dev/issue/78407"}],"credits":[{"name":"Tristan Madani"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-4961","review_status":"REVIEWED"}}