CVE-2026-42500

Description

Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.

PUBLISHED Reserved 2026-04-28 | Published 2026-05-29 | Updated 2026-05-29 | Assigner Go

Problem types

CWE-129: Improper Validation of Array Index

Product status

References

go.dev/issue/79576

groups.google.com/g/golang-announce/c/uhYX90BlBvI

go.dev/cl/781500

pkg.go.dev/vuln/GO-2026-5031

cve.org (CVE-2026-42500)

nvd.nist.gov (CVE-2026-42500)

Download JSON