CVE-2026-46601

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Jun 25, 2026

CISA due date

—

The record

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.

Ecosystem	Package	Introduced	Fixed