CVE-2026-33812: golang image

CVSS: 6.1v3.1MediumAnalyzed

AliasesUBUNTU-CVE-2026-33812DEBIAN-CVE-2026-33812CGA-22wg-q4p7-8h7w+165 more

Published 21-04-2026Last modified 21-04-2026

Vulnerability summary

CVE-2026-33812 is a medium (CVSS 6.1) vulnerability in golang image. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.9% of scored vulnerabilities.

Overall risk

24/100

0100

Low · default modelHow is this calculated?

CVSS score

6.1/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.16%

0%100%

Low · +0.05 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3

OPENSUSE-SU-2026:21483-1 RHSA-2026:66266 CGA-Q4QR-PVX7-F4WJ

Timeline

21-04-2026
PublishedVulnerability first disclosed.
21-04-2026
Last modifiedVulnerability information updated.

Description

Parsing a malicious font file can cause excessive memory allocation.

CVSS metrics

6 scores · 6 sources · 1 version

v3.16.1

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

+0.05 pp

From 0.11% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.16%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Chainguard59 products

bentoAll versions (No fix recorded)
bento-fipsAll versions (No fix recorded)
cgAll versions (No fix recorded)
chainctlAll versions (No fix recorded)
chainctl-fipsAll versions (No fix recorded)

commercial-chainloop-backendAll versions (No fix recorded)
gatusAll versions (No fix recorded)
gatus-fipsAll versions (No fix recorded)
giteaAll versions (No fix recorded)
gitea-fipsAll versions (No fix recorded)
gitlab-workhorse-ce-18.10All versions (No fix recorded)
gitlab-workhorse-ce-18.11All versions (No fix recorded)
gitlab-workhorse-ce-18.3All versions (No fix recorded)
gitlab-workhorse-ce-18.4All versions (No fix recorded)
gitlab-workhorse-ce-18.5All versions (No fix recorded)
gitlab-workhorse-ce-18.6All versions (No fix recorded)
gitlab-workhorse-ce-18.7All versions (No fix recorded)
gitlab-workhorse-ce-18.8All versions (No fix recorded)
gitlab-workhorse-ce-18.9All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.10All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.11All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.3All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.4All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.5All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.6All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.7All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.8All versions (No fix recorded)
gitlab-workhorse-ce-fips-18.9All versions (No fix recorded)
glabAll versions (No fix recorded)
kubescapeAll versions (No fix recorded)
kubescape-serverAll versions (No fix recorded)
kubescape-server-fipsAll versions (No fix recorded)
kubescape-server-fips-downloaderAll versions (No fix recorded)
listmonkAll versions (No fix recorded)
mattermost-10.11All versions (No fix recorded)
mattermost-10.12All versions (No fix recorded)
mattermost-11.0All versions (No fix recorded)
mattermost-11.1< 11.1.3-r5
mattermost-11.2All versions (No fix recorded)
mattermost-11.4All versions (No fix recorded)
mattermost-11.5All versions (No fix recorded)
mattermost-11.6All versions (No fix recorded)
mattermost-11.7All versions (No fix recorded)
mattermost-fips-10.11All versions (No fix recorded)
mattermost-fips-10.12All versions (No fix recorded)
mattermost-fips-10.5All versions (No fix recorded)
mattermost-fips-11.0All versions (No fix recorded)
mattermost-fips-11.1< 11.1.3-r6
mattermost-fips-11.2< 11.2.4-r13
mattermost-fips-11.4All versions (No fix recorded)
mattermost-fips-11.5All versions (No fix recorded)
mattermost-fips-11.6All versions (No fix recorded)
mattermost-fips-11.7All versions (No fix recorded)
ollamaAll versions (No fix recorded)
ollama-fipsAll versions (No fix recorded)
seaweedfs-operator-fipsAll versions (No fix recorded)
seaweedfs-rocksdbAll versions (No fix recorded)
seaweedfs-rocksdb-fipsAll versions (No fix recorded)
tailscaleAll versions (No fix recorded)

Show all 59

Wolfi12 products

bentoAll versions (No fix recorded)
gatusAll versions (No fix recorded)
giteaAll versions (No fix recorded)
glabAll versions (No fix recorded)
kubescapeAll versions (No fix recorded)

Show all 12

Debian1 product

golang-golang-x-imageAll versions (No fix recorded) | < 0.39.0-1

Golang1 product

image< 0.39.0

Golang.org/x1 product

image< 0.39.0

Golang.org/x/image1 product

golang.org/x/image/font/sfnt< 0.39.0

Ubuntu1 product

golang-golang-x-imageAll versions (No fix recorded)

7 vendors · 76 products

References

11 links

go.dev/cl/761180WEBFIXPatch
go.dev/issue/78382WEBREPORTIssue Tracking
pkg.go.dev/vuln/GO-2026-4962WEBVendor Advisory
ubuntu.com/security/CVE-2026-33812REPORT
www.cve.org/CVERecord?id=CVE-2026-33812REPORT
go-review.googlesource.com/c/image/+/761180REPORT
github.com/golang/go/issues/78382REPORT
security-tracker.debian.org/tracker/CVE-2026-33812Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33812.jsonAdvisory

Show all 11 references

nvd.nist.gov/vuln/detail/CVE-2026-33812Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities