CVE-2026-42500
Public on 2026-05-29
Modified on 2026-06-01
Description
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | amazon-cloudwatch-agent | Not Affected | ||
| Amazon Linux 2023 | amazon-cloudwatch-agent | Not Affected | ||
| Amazon Linux 2 - Core | amazon-ssm-agent | Not Affected | ||
| Amazon Linux 2023 | amazon-ssm-agent | Not Affected | ||
| Amazon Linux 2 - Core | cni-plugins | Not Affected | ||
| Amazon Linux 2023 | cni-plugins | Not Affected | ||
| Amazon Linux 2 - Aws-nitro-enclaves-cli Extra | containerd | Not Affected | ||
| Amazon Linux 2 - Docker Extra | containerd | Not Affected | ||
| Amazon Linux 2 - Ecs Extra | containerd | Not Affected | ||
| Amazon Linux 2023 | containerd | Not Affected | ||
| Amazon Linux 2023 | credentials-fetcher | Not Affected | ||
| Amazon Linux 2 - Core | cri-tools | Not Affected | ||
| Amazon Linux 2 - Aws-nitro-enclaves-cli Extra | docker | Not Affected | ||
| Amazon Linux 2 - Docker Extra | docker | Not Affected | ||
| Amazon Linux 2 - Ecs Extra | docker | Not Affected | ||
| Amazon Linux 2023 | docker | Not Affected | ||
| Amazon Linux 2 - Ecs Extra | ecs-init | Not Affected | ||
| Amazon Linux 2023 | ecs-init | Not Affected | ||
| Amazon Linux 2023 | git-lfs | Not Affected | ||
| Amazon Linux 2 - Core | golang | Not Affected | ||
| Amazon Linux 2 - Core | nerdctl | Not Affected | ||
| Amazon Linux 2023 | nerdctl | Not Affected | ||
| Amazon Linux 2 - Core | rclone | Not Affected | ||
| Amazon Linux 2023 | rclone | Pending Fix | ||
| Amazon Linux 2 - Docker Extra | runfinch-finch | Not Affected | ||
| Amazon Linux 2023 | runfinch-finch | Not Affected | ||
| Amazon Linux 2 - Docker Extra | soci-snapshotter | Not Affected | ||
| Amazon Linux 2023 | soci-snapshotter | Not Affected | ||
| Amazon Linux 2023 | yq | Not Affected |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |