Read the docs
TI-2026-26184 Aliases CVE-2026-33812

Excessive memory allocation when decoding malicious SFNT in golang.org/x/image

Priority LOW 26CWE-770Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
Low · None · High
Fix status
Partial Red Hat: 1 fixed, 17 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

Parsing a malicious font file can cause excessive memory allocation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00112 1st percentileScored 2026-11-07
Fix Partial golang.org/x/image/font/sfnt (golang.org/x/image): 0.39.0Red Hat: 1 advisoryRed Hat: 1 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarygolang.org/x/image/font/sfntbefore 0.39.00.39.0Patch availableCNA
  • golang.org/x/image/font/sfnt VendorGo standard library Affected before 0.39.0 Fixed in 0.39.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:image:*:*:*:*:*:go:*:*before 0.39.0VulnerableGo standard library
  • cpe:2.3:a:golang:image:*:*:*:*:*:go:*:* Versions before 0.39.0 Vulnerable ·Go standard library

Remediation

  • Fix · CNA golang.org/x/image/font/sfnt (golang.org/x/image) Fixed in 0.39.0

Red Hat 1 advisory

  • RHSA-2026:66266 Released 2026-09-09 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images hugo-0.166.0-0.1.hum1@aarch64, hugo-0.166.0-0.1.hum1@src, hugo-0.166.0-0.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet: Fix deferred
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet: Fix deferred
Multicluster Global HubAffectedNo fix yet: Fix deferred
OpenShift ServerlessAffectedNo fix yet: Fix deferred
OpenShift Service Mesh 2AffectedNo fix yet: Fix deferred
OpenShift Service Mesh 3AffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift GitOpsAffectedNo fix yet: Fix deferred
Red Hat OpenShift Virtualization 4AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 18.0AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:66266
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33812

References

Patch 1

Advisory 1

Other 1

  • TI-2026-26185 Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image CVSS 3.1HIGH 7.5
  • TI-2023-13788 Excessive resource consumption in golang.org/x/image/tiff CVSS 3.1MEDIUM 6.5
  • TI-2023-13787 Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff CVSS 3.1MEDIUM 6.5
  • TI-2022-20117 Denial of service via crafted TIFF image in golang.org/x/image/tiff CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences