CVE-2026-42500: BMP Image Buffer Overflow Vulnerability

CVE-2026-42500 Overview

CVE-2026-42500 is a denial-of-service vulnerability in the Go standard library's BMP image decoder. Decoding a paletted BMP file containing an out-of-range palette index produces a decoded image structure. Subsequent pixel access on that image triggers a runtime panic. Applications that ingest untrusted BMP files and then read pixel data are exposed to crash conditions. The issue is tracked by the Go vulnerability database as GO-2026-5031 and was disclosed via the official Go announcement channels.

Critical Impact
Remote attackers can supply a crafted paletted BMP file to crash Go applications that decode and access pixels in untrusted images, producing an availability impact without requiring authentication or user interaction.

Affected Products

Go standard library BMP image decoder (golang.org/x/image/bmp)
Go applications that decode untrusted paletted BMP images
Services exposing image processing endpoints built on the affected package

Discovery Timeline

2026-05-29 - CVE-2026-42500 published to the National Vulnerability Database
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-42500

Vulnerability Analysis

The flaw resides in the BMP decoder's handling of paletted images. A paletted BMP file references colors by index into a color table. The decoder accepts files in which pixel data references indexes outside the bounds of the declared palette. The decoder does not reject these files or substitute a safe default. When calling code later accesses pixels in the resulting image, the index lookup exceeds the palette slice and Go's runtime triggers a panic. Unrecovered panics terminate the goroutine and, in many server designs, crash the process. The defect is an input validation failure that produces an out-of-bounds read condition at pixel access time.

Root Cause

The BMP decoder fails to validate that every palette index encoded in the pixel data falls within the bounds of the parsed color palette. Validation is deferred until pixel access, where Go's bounds-checked slice indexing converts the malformed input into a runtime panic instead of a returned error.

Attack Vector

An unauthenticated attacker uploads or otherwise submits a crafted paletted BMP file to an application that uses the affected decoder. When the application calls a method such as At(x, y) or iterates pixels for resizing, thumbnailing, or format conversion, the panic fires and disrupts service availability.

// No verified proof-of-concept code is published.
// See the Go vulnerability advisory GO-2026-5031 for technical details.

Detection Methods for CVE-2026-42500

Indicators of Compromise

Unexpected process crashes or goroutine panics in Go services that handle image uploads
Stack traces referencing image/color.Palette index operations or the bmp decoder
Spikes in HTTP 500 responses correlated with BMP file uploads from untrusted sources

Detection Strategies

Inspect application logs for runtime panics originating in BMP decoding or pixel access code paths.
Audit dependency manifests (go.mod, go.sum) for unpatched versions of golang.org/x/image/bmp.
Run govulncheck against build artifacts to identify code paths reaching GO-2026-5031.

Monitoring Recommendations

Monitor restart rates and crash loops on services that accept user-supplied images.
Alert on repeated BMP uploads followed by service errors from the same client.
Track image processing latency and error counters for anomalies indicating decoder failures.

How to Mitigate CVE-2026-42500

Immediate Actions Required

Upgrade golang.org/x/image to the fixed version referenced in Go.dev Vulnerability Advisory GO-2026-5031.
Rebuild and redeploy any Go binaries that statically link the affected package.
Run govulncheck across the codebase to confirm no vulnerable call paths remain.

Patch Information

The Go project addressed the issue in the change tracked at Go CL 781500 and described in Go issue 79576. Coordinated disclosure was published through the golang-announce mailing list. Update to the patched release of golang.org/x/image/bmp and recompile dependent applications.

Workarounds

Restrict accepted image formats and reject BMP uploads at the application gateway until patches are applied.
Wrap decoder and pixel-access calls in recover() to convert panics into handled errors and preserve process availability.
Validate image dimensions and palette sizes before invoking pixel access on decoded images from untrusted sources.

bash

# Configuration example
go get -u golang.org/x/image@latest
govulncheck ./...