CVE-2026-33812

Go/golang.org/x/image CVE-2026-33812: unknown

Excessive memory allocation when decoding malicious SFNT in golang.org/x/image

Action: Upgrade golang.org/x/image to 0.39.0 or later.

go get golang.org/x/image@v0.39.0

Affected

Fixed versions

Sources

• osv: GO-2026-4962
• https://go.dev/cl/761180
• https://go.dev/issue/78382

CVE-2026-33812 · published 2026-04-21T18:59:51Z · modified 2026-09-22T10:41:47.722840128Z · JSON