A vulnerability in the golang.org x/image/webp package allows unauthenticated attackers to cause a denial of service via a specially crafted WEBP image.

The flaw exists due to an integer overflow during the parsing of WEBP image dimensions. An unauthenticated attacker can exploit this by providing a malicious image file, which causes the application to panic and crash on 32-bit systems.

The vulnerability carries a CVSS score of 7.5, indicating a high risk to availability. Successful exploitation results in a crash of the affected service, which can cause significant operational downtime and service disruption for users relying on systems that process image files.

Immediate Action: Update the golang.org/x/image/webp package to version 0.42.0 or later to include the necessary integer overflow protections.

Proactive Monitoring: Monitor application logs for unexpected service restarts or panic stack traces associated with image processing functions.

Compensating Controls: Implement strict input validation or file size limits for image uploads to reject malformed WEBP files before they reach the processing layer.

Public Exploit Available: No

This vulnerability presents a clear denial of service risk to any application utilizing the affected Go package on 32-bit architectures. Security teams should prioritize updating their dependencies to version 0.42.0 immediately to eliminate this attack vector and ensure system stability.