---
id: CVE-2026-33812
aliases:
  - GO-2026-4962
title: Excessive memory allocation when decoding malicious SFNT in golang.org/x/image
summary: Excessive memory allocation when decoding malicious SFNT in golang.org/x/image
severity: none
vendor: x
product: golang.org/x/image
ecosystem: go
affected:
  - golang.org/x/image < 0.39.0
patched:
  - golang.org/x/image 0.39.0
published: '2026-04-21'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T10:41:47.722840128Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-4962'
references:
  - url: 'https://go.dev/cl/761180'
  - url: 'https://go.dev/issue/78382'
tags:
  - osv
  - go
epss: 0.00162
epssPercentile: 0.04602
ingestedAt: '2026-09-24T07:16:01.865Z'
---

## Overview

Parsing a malicious font file can cause excessive memory allocation.

## Affected packages

- `golang.org/x/image < 0.39.0`

## Remediation

Upgrade to a patched release:

- `golang.org/x/image 0.39.0`