PT-2026-34049 · Go · Golang.Org/X/Image

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-33812

OSV

CVSS v3.1

6.1

Medium

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Parsing a malicious font file can cause excessive memory allocation.

Fix

Related Identifiers

CVE-2026-33812

GO-2026-4962

Affected Products

Golang.Org/X/Image

References · 5

• https://osv.dev/vulnerability/GO-2026-4962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33812 · Security Note
• https://go.dev/issue/78382 · Note
• https://go.dev/cl/761180 · Note
• https://pkg.go.dev/vuln/GO-2026-4962 · Note