A WebP image decoder in golang.org/x/image/webp panics when parsing an image whose reported size field is invalid and excessively large. The failure to properly validate the size during decoding causes a panic on 32‑bit platforms, terminating the application. The resulting crash means an attacker can trigger a denial of service by supplying a crafted WebP file that exploits this unchecked size value.

The description does not provide affected‑version details. Therefore, the vulnerability is understood to affect any release of golang.org/x/image/webp that is executed on 32‑bit operating systems. No specific version range is listed in the CVE data, so the scope cannot be narrowed further.

To trigger the issue, an attacker would need to supply a malicious WebP file with an oversized size field. On compatible 32‑bit systems, the decoder will panic and terminate the process. No public exploit is documented, and the EPSS score of < 1% indicates a very low probability of exploitation at this time. The CVSS score of 7.5 identifies moderate to high potential impact if the flaw were successfully leveraged, but the combination of low exploitation likelihood and lack of widespread CVE listings reduces the immediate threat for exposed services.