Vulnerability Report: GO-2026-4962

Affected Packages

• Path
  Versions
  Symbols
• golang.org/x/image/font/sfnt
  before v0.39.0
  13 affected symbols

  • Collection.Font
  • Font.GlyphAdvance
  • Font.GlyphBounds
  • Font.GlyphIndex
  • Font.GlyphName
  • Font.Kern
  • Font.LoadGlyph
  • Font.Name
  • Font.WriteSourceTo
  • Parse
  • ParseCollection
  • ParseCollectionReaderAt
  • ParseReaderAt

Aliases

• CVE-2026-33812

References

• https://go.dev/cl/761180
• https://go.dev/issue/78382
• https://vuln.go.dev/ID/GO-2026-4962.json

Credits

• Andy Gill, ZephrSec Ltd

Feedback