CVE-2026-42500: golang.org/x/image golang.org/x/image/bmp
CVSS: 5.3v3.1MediumDeferred
AliasesUBUNTU-CVE-2026-42500DEBIAN-CVE-2026-42500CGA-7xqg-37fw-6g7jCGA-882j-492p-38fjCGA-fv7p-49fh-q44pCGA-g7vc-hcq7-fj43CGA-hf34-453g-9mj6CGA-hvv5-88jx-93gxCGA-qfrc-jq7g-q885CGA-qmj5-v2vp-hxj4GO-2026-5031CGA-28g6-ccc6-m9j8CGA-2g7w-jwh4-8cgfCGA-2gj2-7c63-4598CGA-3554-m4mp-h8v4CGA-384q-83wf-5p8cCGA-3rhf-xq55-76pwCGA-47m5-cr37-2mq6CGA-4f92-j554-qfprCGA-4rhx-4hvq-2x5qCGA-4rp9-3j24-v54mCGA-5p9f-3qxc-r6fwCGA-5ppf-4589-chvqCGA-5rrw-38wg-jf76CGA-68f5-qrpx-74mjCGA-68ph-w3f5-pc9rCGA-6jhx-xjch-f2p2CGA-6qx2-hp88-wqj7CGA-6w3q-cw7w-8756CGA-7342-q52p-63m5CGA-743c-586w-v3x8CGA-7jr9-75v9-g9hfCGA-7qvc-x4h5-4826CGA-7x77-297c-h2hgCGA-85r8-r2wr-g8qvCGA-8mhw-gwfp-wq38CGA-8x2q-mgmc-82rrCGA-8xr9-6gvj-gcrpCGA-94p4-x2wg-67f4CGA-98c6-jjx8-x27wCGA-9c36-hfqv-q478CGA-9g86-wm4j-wcfpCGA-9q2w-wqc9-8vc3CGA-c39g-ch4h-hjqhCGA-c4f7-c5h9-7v29CGA-c5vw-9pjv-6qcvCGA-c8f5-3qg3-84c3CGA-c8g6-9pfj-47v3CGA-cg83-2h72-v6p9CGA-cgm6-887j-6rwfCGA-cq36-w5vg-274wCGA-cvg2-h595-w4gcCGA-fjq3-g5xf-rhprCGA-fp8j-mcqr-rvxfCGA-fxfc-2f83-69r7CGA-g998-mwmw-9j9mCGA-gv54-pqmc-36qxCGA-gwgg-6gxv-5352CGA-h744-7cr9-jccrCGA-h758-w67j-8f95CGA-hcfj-hxr4-8mjwCGA-hg95-55f8-j925CGA-hjmc-fq45-cw33CGA-hjvq-rjg7-fp7rCGA-j777-843c-25w2CGA-j9wq-gq5v-pp4rCGA-jw37-v68j-xhvhCGA-jwgf-ww74-qj56CGA-jwj4-m6v3-5274CGA-m3j5-2c88-rxfcCGA-m57v-p8fm-9h8hCGA-mr48-8jh4-5f4gCGA-p3cr-h4vj-43fcCGA-p46r-g8pc-4vcrCGA-p4m2-cvp4-v82fCGA-p7rr-3xmv-qr3xCGA-pv9w-c56w-xj8pCGA-q46r-mq29-7hr8CGA-q6g7-qhjp-27q3CGA-qr6w-62xx-4fw2CGA-qxvq-vc4j-2499CGA-r8gp-mjcf-44m3CGA-rqgp-75wp-6hvxCGA-v4f4-crxx-qp34CGA-vhvm-2c25-g6pwCGA-w5f5-7h8c-xv5hCGA-w7xx-4jhq-hm44CGA-w9p9-cpq9-xm7pCGA-wmgf-88mr-x9w7CGA-wq34-rjjg-2cj2CGA-wv9g-3vhm-w5v2CGA-ww86-jhp5-8qrgCGA-wwx6-997x-ghg4CGA-x339-j86x-67f9CGA-x88r-4457-w3whCGA-xf95-5fhg-66qpCGA-xm8x-j925-c8v3CGA-xpch-7crm-6xw7CGA-xqh7-r2m4-253mCGA-xv9c-wxp5-w76rCGA-xvpp-c3x7-xg7p
Published 29-05-2026Last modified 29-05-2026
Vulnerability summary
CVE-2026-42500 is a medium (CVSS 5.3) vulnerability in golang.org/x/image golang.org/x/image/bmp. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.5% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.52%
0%100%
Low · +0.14 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 29-05-2026PublishedVulnerability first disclosed.
- 29-05-2026Last modifiedVulnerability information updated.
Description
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
+0.14 pp
From 0.38% on 21-09-2026
21-09-202621-10-2026
EPSS score0.52%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard33 products
- cgAll versions (No fix recorded)
- chainctlAll versions (No fix recorded)
- chainctl-fipsAll versions (No fix recorded)
- commercial-chainloop-backendAll versions (No fix recorded)
- gatusAll versions (No fix recorded)
Wolfi4 products
- gatusAll versions (No fix recorded)
- glabAll versions (No fix recorded)
- seaweedfs< 4.34-r1
- tailscaleAll versions (No fix recorded)
Debian1 product
- golang-golang-x-imageAll versions (No fix recorded) | < 0.42.0-1
Golang.org/x1 product
- image< 0.41.0
Golang.org/x/image1 product
- golang.org/x/image/bmp< 0.41.0
Ubuntu1 product
- golang-golang-x-imageAll versions (No fix recorded)
6 vendors · 41 products
References
9 links- go.dev/issue/79576REPORT
