Is CVE-2026-33812 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33812 being exploited in the wild.

How severe is CVE-2026-33812?

Medium severity, with a CVSS score of 6.1, published 21 April 2026.

Which products and versions are affected?

golang.org/x/image (Go) SEMVER:introduced=0,fixed=0.39.0; Go Project Sfnt < 0.39.0.

Is there a fix for CVE-2026-33812?

Yes. golang.org/x/image (Go): upgrade to 0.39.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33812 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-33812?

Check whether you run golang.org/x/image (Go), image (Go) or Go Project Sfnt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33812: Go x/image/font/sfnt denial of service via excessive memory allocation

Q: Is there a fix for CVE-2026-33812?

Yes. golang.org/x/image (Go): upgrade to 0.39.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33812 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-33812?

Check whether you run golang.org/x/image (Go), image (Go) or Go Project Sfnt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33812 · Severity: medium · CVSS 6.1 · Published 2026-04-21

A vulnerability in the Go image library's font parsing component can allow a malicious font file to crash an application. By providing a specially crafted font file, an attacker can force the system to attempt a massive memory allocation (up to 8GB), leading to an Out-of-Memory (OOM) error. This could disrupt services or applications that process user-uploaded fonts or display external font content.

Technologies: golang.org/x/image (Go). Vendors: Go, Go Project.

Quick answers

Is CVE-2026-33812 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33812 being exploited in the wild.
How severe is CVE-2026-33812?: Medium severity, with a CVSS score of 6.1, published 21 April 2026.
Which products and versions are affected?: golang.org/x/image (Go) SEMVER:introduced=0,fixed=0.39.0; Go Project Sfnt < 0.39.0.
Is there a fix for CVE-2026-33812?: Yes. golang.org/x/image (Go): upgrade to 0.39.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33812 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-33812?: Check whether you run golang.org/x/image (Go), image (Go) or Go Project Sfnt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/image (Go): upgrade to 0.39.0 or later
```
go get golang.org/x/image@v0.39.0
```

Technical details

A vulnerability exists in the golang.org/x/image/font/sfnt package when parsing GPOS (Glyph Positioning) tables in font files. Specifically, in the parsePairPosFormat2 function, the values for numClass1 and numClass2 are read as uint16 from the file without validation. Their product is used to determine the size of a memory allocation; if both are set to maximum values, the library attempts to allocate approximately 8 GiB of memory, leading to an Out-of-Memory (OOM) crash. This issue primarily affects the io.ReaderAt path. Additionally, the library lacked proper bounds checks for indices and overflow checks in varLenView. The issue is fixed in version 0.39.0 by validating class count products against maxTableLength.

Affected products

Go Project golang.org/x/image/font/sfnt < 0.39.0

Identifiers

CVE-2026-33812
GO-2026-4962

Timeline

2026-03-26: disclosed: Issue reported to Go security team
2026-04-21: advisory: CVE-2026-33812 published
2026-05-13: patched: NIST analysis completed and patch confirmed in v0.39.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.