CVE-2026-46603
Received Received - Intake

Memory Exhaustion in Go VP8L Decoding

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: Go Project

Description
VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-46603
EUVD
EUVD-2026-58720

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
golang go From 1.0.0 (inc)
golang golang to v0.45.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves excessive memory allocation in Go's vp8l image decoder. When processing a crafted VP8L image with many unused Huffman tree groups, the decoder allocates memory for all groups even if they are not used by any tile. This leads to significant memory consumption, potentially up to 1.4 GiB for a small image, causing a denial of service via memory exhaustion.

Detection Guidance

To detect this vulnerability, inspect Go applications using the golang.org/x/image/vp8l package for excessive memory usage when processing VP8L images. Monitor system memory during image processing tasks. Check for crashes or slowdowns when handling crafted images with many unused Huffman tree groups.

Impact Analysis

If you process untrusted VP8L images in Go applications using golang.org/x/image/vp8l before v0.45.0, an attacker could send a malicious image to exhaust system memory. This may crash your application or system, disrupting services and causing downtime.

Mitigation Strategies

Update the golang.org/x/image package to version v0.45.0 or later. If updating is not possible, restrict processing of untrusted VP8L images or implement memory limits during image decoding. Follow the mitigation approach used in libwebp by discarding unused Huffman tree groups.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart