Executive brief
A vulnerability in the Go image library's font parsing component can allow a malicious font file to crash an application. By providing a specially crafted font file, an attacker can force the system to attempt a massive memory allocation (up to 8GB), leading to an Out-of-Memory (OOM) error. This could disrupt services or applications that process user-uploaded fonts or display external font content.
Technical details
A vulnerability exists in the golang.org/x/image/font/sfnt package when parsing GPOS (Glyph Positioning) tables in font files. Specifically, in the parsePairPosFormat2 function, the values for numClass1 and numClass2 are read as uint16 from the file without validation. Their product is used to determine the size of a memory allocation; if both are set to maximum values, the library attempts to allocate approximately 8 GiB of memory, leading to an Out-of-Memory (OOM) crash. This issue primarily affects the io.ReaderAt path. Additionally, the library lacked proper bounds checks for indices and overflow checks in varLenView. The issue is fixed in version 0.39.0 by validating class count products against maxTableLength.
Affected products
- Go Project golang.org/x/image/font/sfnt < 0.39.0
Timeline
- 2026-03-26: disclosed: Issue reported to Go security team
- 2026-04-21: advisory: CVE-2026-33812 published
- 2026-05-13: patched: NIST analysis completed and patch confirmed in v0.39.0