CVE-2026-33813
Golang Image ≤ 0.39.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-33813 is a high-severity an unspecified weakness vulnerability in Golang Image. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33813 affects the Go programming language's WEBP image parsing component. On 32-bit platforms, parsing a WEBP image with an invalid, large size triggers a panic, resulting in denial of service. The vulnerability received a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for high availability impact without requiring privileges or user interaction.
Remote attackers can exploit this vulnerability by providing a specially crafted WEBP image to any network-accessible Go application that processes WEBP files. No authentication is needed, and exploitation leads to an application crash or panic, disrupting service availability on affected 32-bit systems.
The Go vulnerability advisory GO-2026-4961 documents the issue, with a fix submitted in change list https://go.dev/cl/759860 and further details in issue tracker entry https://go.dev/issue/78407. Security practitioners should consult https://pkg.go.dev/vuln/GO-2026-4961 for patching guidance and update affected Go installations accordingly.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24247
Vulnerability Data
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.