---
id: CVE-2026-42500
aliases:
  - GO-2026-5031
title: Panic when reading out of bound palette index in golang.org/x/image/bmp
summary: Panic when reading out of bound palette index in golang.org/x/image/bmp
severity: none
vendor: x
product: golang.org/x/image
ecosystem: go
affected:
  - golang.org/x/image < 0.41.0
patched:
  - golang.org/x/image 0.41.0
published: '2026-05-29'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T10:41:48.522670889Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5031'
references:
  - url: 'https://go.dev/issue/79576'
  - url: 'https://groups.google.com/g/golang-announce/c/uhYX90BlBvI'
  - url: 'https://go.dev/cl/781500'
tags:
  - osv
  - go
epss: 0.00524
epssPercentile: 0.4201
ingestedAt: '2026-09-24T07:16:01.868Z'
---

## Overview

Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.

## Affected packages

- `golang.org/x/image < 0.41.0`

## Remediation

Upgrade to a patched release:

- `golang.org/x/image 0.41.0`