CVE-2026-33812 Details

A vulnerability exists in the Golang package 'golang.org/x/image/font/sfnt' prior to version 0.39.0, where parsing a malicious font file can lead to excessive memory allocation. This issue arises in the 'io.ReaderAt' path when the 'GPOS PairPos' tables are processed. The vulnerability allows for a multi-gigabyte allocation that can crash the process, as unchecked class counts from the font file are multiplied and can exceed available memory. Additionally, the parsing functions do not validate that derived indices are within bounds, further exacerbating the issue.

Users should update to 'golang.org/x/image' version 0.39.0 or later, where this vulnerability has been addressed by adding proper validation and bounds checks in the 'GPOS' parsing to prevent excessive memory allocation.