PT-2026-43022 · Rclone · Rclone

Uuganbayar Lkhamsuren · Published 2026-05-24 · Updated 2026-05-30 · CVE-2026-42500

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.74.2-1.1

Description Decoding a paletted BMP file with an out-of-range palette index causes a panic when accessing pixels in the invalid image.

Recommendations Update to version 1.74.2-1.1.

Fix

Related Identifiers

CVE-2026-42500

GO-2026-5031

OPENSUSE-SU-2026:10856-1

Affected Products

Rclone

References · 39

• https://security-tracker.debian.org/tracker/CVE-2026-42500 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5031 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10856-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42500 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42500 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42500 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42500 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42500 · Security Note
• https://github.com/golang/go/issues/79576 · Note
• https://twitter.com/VulmonFeeds/status/2060540545106141351 · Twitter Post
• https://suse.com/security/cve/CVE-2026-39835 · Note
• https://suse.com/security/cve/CVE-2026-39828 · Note
• https://go-review.googlesource.com/c/image/+/781500 · Note
• https://suse.com/security/cve/CVE-2026-39821 · Note
• https://suse.com/security/cve/CVE-2026-39829 · Note