Description

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-14T17:18:15.307Z",
  "pubdate": "2026-08-14T17:18:15.307Z",
  "executiveSummary": "A memory exhaustion vulnerability exists in the VP8L decoding implementation within golang.org/x/image/vp8l.\nThe vulnerability is classified as an excessive memory allocation issue leading to a denial of service (DoS).\nIt affects systems processing untrusted image data using the vulnerable Go package.\nA remote attacker can exploit this flaw by supplying a specially crafted VP8L image containing an excessive number of unused Huffman tree groups.\nSuccessful exploitation forces the decoding process to consume disproportionate amounts of system memory, resulting in application crashes or host resource starvation.\nNo authentication or elevated privileges are required to trigger the vulnerability, as it manifests entirely during the parsing and decoding of externally supplied image payloads over network or file-processing vectors.",
  "technicalDetails": "The vulnerability resides in the VP8L decoding logic of the golang.org/x/image/vp8l package, specifically within the handling of Huffman tree group structures.\nThe root cause is the lack of proper validation or bounds checking regarding the number of Huffman tree groups declared within the VP8L bitstream versus the actual usage requirements of the image data.\nWhen a crafted VP8L image containing numerous unused Huffman tree groups is processed, the vulnerable component allocates memory structures proportional to the declared count rather than the operational needs of the decode routine.\nThe attack flow begins when an application accepts and attempts to decode a malicious VP8L image provided by a remote attacker.\nAs the decoder parses the image header and metadata, it encounters the inflated count of Huffman tree groups and initiates memory allocation operations for each declared group.\nBecause the groups are unused, no meaningful data populates these structures, yet the underlying memory allocations still consume significant RAM resources.\nThis behavior leads to rapid heap consumption, triggering out-of-memory (OOM) conditions that terminate the host process.\nNetwork exposure depends on the application architecture, typically affecting web servers, image processing microservices, or client applications that ingest untrusted image streams.\nAuthentication and privilege requirements are absent, as the vector relies solely on the processing of a malformed input file or network stream.\nThe post-exploitation impact is limited to denial of service through resource exhaustion, with no evidence of remote code execution or arbitrary read/write primitives."
}