CVE-2026-33812: 
NixOS vulnerability analysis and mitigation

CVE-2026-33812 is a resource exhaustion vulnerability in the Go golang.org/x/image package (specifically the font/sfnt component) that allows parsing a malicious font file to cause excessive memory allocation. It affects all versions of golang.org/x/image prior to 0.39.0. The vulnerability was published on April 21, 2026, with a patch released on May 13, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium), though Feedly's category estimate rates it as HIGH (Feedly, pkg.go.dev).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), where the SFNT font parser in golang.org/x/image/font/sfnt fails to impose adequate bounds on memory allocation when processing attacker-controlled font data. An attacker can craft a malicious font file that, when parsed by a vulnerable application, triggers unbounded memory allocation. Exploitation requires local access and user interaction (e.g., an application or user opening the malicious font file). The fix is tracked in Go change list CL-761180 and Go issue #78382 (pkg.go.dev, Go CL).

Successful exploitation primarily impacts availability, as the excessive memory allocation can exhaust system memory and cause the affected application or process to crash or become unresponsive (denial of service). There is also a low confidentiality impact, potentially exposing memory contents depending on application behavior. Integrity is not affected. The scope is limited to the affected process and does not provide a direct path to lateral movement or remote code execution (Feedly, pkg.go.dev).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-33812. The EPSS score is very low at approximately 0.012%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a user or application to parse a specially crafted font file, limiting the attack surface to scenarios where untrusted font files are processed (Feedly).

1. Craft malicious font file: Create a specially crafted SFNT/OpenType font file with malformed or oversized data structures designed to trigger unbounded memory allocation in the golang.org/x/image/font/sfnt parser.
2. Deliver the font file: Deliver the malicious font file to a target system via email attachment, file share, web download, or any other vector where the file will be processed by a Go application using the vulnerable library.
3. Trigger parsing: Induce the target application (or user) to open or process the malicious font file, causing the vulnerable font/sfnt parser to allocate excessive memory.
4. Achieve denial of service: The application exhausts available memory, resulting in a crash, out-of-memory kill, or severe performance degradation (pkg.go.dev, Go CL).

• Process: Go application processes consuming abnormally high or rapidly growing memory when processing font files; OOM (out-of-memory) kills of Go application processes.
• Logs: Application crash logs or stack traces referencing golang.org/x/image/font/sfnt during font parsing operations; system logs showing OOM killer events (oom_kill_process) targeting Go applications.
• File System: Presence of unexpected or externally sourced font files (.ttf, .otf, .woff) in application directories or temporary folders.

Upgrade golang.org/x/image to version 0.39.0 or later, which includes the fix for this vulnerability (Go CL 761180). Applications that process untrusted font files should be updated as a priority. As a workaround where upgrading is not immediately possible, restrict the processing of untrusted or externally sourced font files within affected applications. Amazon Linux 2023 users can apply the update via ALAS2023-2026-1810 (pkg.go.dev, Go CL, Amazon Advisory).

Coverage of CVE-2026-33812 has been limited to automated vulnerability tracking platforms and scanner plugins (e.g., Tenable Nessus plugins 309685 and 319812), with no notable researcher commentary or significant social media discussion identified. The vulnerability's moderate severity and requirement for user interaction have kept community interest low.