{"id":"CVE-2026-33812","sourceIdentifier":"security@golang.org","published":"2026-04-21T20:16:56.290","lastModified":"2026-10-26T21:10:00.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Parsing a malicious font file can cause excessive memory allocation."},{"lang":"es","value":"El análisis de un archivo de fuente malicioso puede causar una asignación excesiva de memoria."}],"affected":[{"source":"security@golang.org","affectedData":[{"vendor":"golang.org/x/image","product":"golang.org/x/image/font/sfnt","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"golang.org/x/image/font/sfnt","programRoutines":[{"name":"source.view"},{"name":"Collection.Font"},{"name":"Font.GlyphAdvance"},{"name":"Font.GlyphBounds"},{"name":"Font.GlyphIndex"},{"name":"Font.GlyphName"},{"name":"Font.Kern"},{"name":"Font.LoadGlyph"},{"name":"Font.Name"},{"name":"Font.WriteSourceTo"},{"name":"Parse"},{"name":"ParseCollection"},{"name":"ParseCollectionReaderAt"},{"name":"ParseReaderAt"}],"versions":[{"version":"0","lessThan":"0.39.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-21T20:43:08.370574Z","id":"CVE-2026-33812","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:golang:image:*:*:*:*:*:go:*:*","versionEndExcluding":"0.39.0","matchCriteriaId":"C0501D26-73D5-4E11-80EE-77576FB64671"}]}]}],"references":[{"url":"https://go.dev/cl/761180","source":"security@golang.org","tags":["Patch"]},{"url":"https://go.dev/issue/78382","source":"security@golang.org","tags":["Issue Tracking"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4962","source":"security@golang.org","tags":["Vendor Advisory"]}]}