What is the CVSS score of EUVD-2026-24245?

EUVD-2026-24245 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-24245?

Yes, a patch is available for EUVD-2026-24245. Update the affected software to the latest version immediately.

Go x/image EUVD-2026-24245

| CVE-2026-33812 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-04-21 Go

Denial Of Service Suse Golang Org X Image Font Sfnt Golang Org X Image

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

vuln.today AI

5.5 MEDIUM

CWE-770 memory exhaustion causes only availability impact; C:L in the provided vector is unsupported by the description and is assessed as C:N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.1 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:09 vuln.today

CVSS changed

Apr 21, 2026 - 21:22 NVD

6.1 (MEDIUM)

Patch released

Apr 21, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 21, 2026 - 20:00 euvd

EUVD-2026-24245

CVE Published

Apr 21, 2026 - 19:21 nvd

MEDIUM 6.1

DescriptionCVE.org

Parsing a malicious font file can cause excessive memory allocation.

AnalysisAI

Excessive memory allocation in the golang.org/x/image/font/sfnt SFNT font parser allows denial of service when processing a malicious font file. All versions of the package prior to 0.39.0 are affected, as confirmed by the Go vulnerability database (GO-2026-4962) and EUVD-2026-24245. An attacker who can supply a crafted font file to any Go application using this library can cause the application to exhaust available memory and crash. No public exploit has been identified and SSVC confirms no active exploitation at time of analysis.

Technical ContextAI

The affected component is the golang.org/x/image/font/sfnt package, part of the Go extended image library maintained under golang.org/x. The sfnt package implements parsing of SFNT-based font formats, which underpin TrueType and OpenType fonts. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: the parser fails to bound memory allocation when processing font table data, allowing a crafted file to drive memory consumption without limit. This is a supplementary library separate from the Go standard library, imported explicitly by applications requiring font parsing. The CPE cpe:2.3:a:golang.org/x/image:golang.org/x/image/font/sfnt:*:*:*:*:*:*:*:* covers all versions of the package across all platforms.

RemediationAI

Upgrade golang.org/x/image to version 0.39.0 or later, which contains the fix as documented in Go change review https://go.dev/cl/761180 and the Go vulnerability advisory at https://pkg.go.dev/vuln/GO-2026-4962. The underlying issue is tracked at https://go.dev/issue/78382. Update go.mod and go.sum accordingly and rebuild affected applications. As a compensating control prior to patching, applications that parse user-supplied font files should reject inputs from untrusted sources at the application boundary before invoking the sfnt parser, or run font parsing in a memory-limited subprocess or sandbox to bound blast radius. Note that the latter approach requires application-level refactoring and may introduce latency.