A WebP image decoder in golang.org/x/image/webp panics when parsing an image with an invalid, very large size on 32‑bit platforms. The panic occurs due to improper handling of the size value during parsing, causing the application to terminate. This failure to validate input leads to a denial of service because the application crashes when encountering the malformed image.

All versions of the golang.org/x/image/webp package used in Go applications on 32‑bit operating systems are affected. The vulnerability is tied to the WebP decoding code and is present until the library is updated with the fix described in the referenced Go issue.

The exploit requires an attacker to supply a crafted WebP file with an oversized size field. On 32‑bit systems, the decoder will panic and terminate the process. No public exploit is listed and the EPSS score is not available, but the impact is a local or remote denial of service if the application accepts external images. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the issue from any environment that feeds WebP data to the decoder, making the risk moderate to high for exposed services.