{"id":"CVE-2026-42500","aliases":["GO-2026-5031"],"title":"Panic when reading out of bound palette index in golang.org/x/image/bmp","summary":"Panic when reading out of bound palette index in golang.org/x/image/bmp","severity":"none","vendor":"x","product":"golang.org/x/image","ecosystem":"go","affected":["golang.org/x/image < 0.41.0"],"patched":["golang.org/x/image 0.41.0"],"published":"2026-05-29","updated":"2026-09-22","sourceUpdated":"2026-09-22T10:41:48.522670889Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5031","references":[{"url":"https://go.dev/issue/79576"},{"url":"https://groups.google.com/g/golang-announce/c/uhYX90BlBvI"},{"url":"https://go.dev/cl/781500"}],"tags":["osv","go"],"epss":0.00384,"epssPercentile":0.32348,"ingestedAt":"2026-09-24T07:16:01.868Z","slug":"CVE-2026-42500","body":"## Overview\n\nDecoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.\n\n## Affected packages\n\n- `golang.org/x/image < 0.41.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `golang.org/x/image 0.41.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}