Parsing a malicious SFNT font file triggers an excessive memory allocation in the golang.org/x/image/font/sfnt package. The flaw can cause the process to consume large amounts of memory, potentially exhausting system resources and leading to a denial of service. The weakness is a form of uncontrolled memory allocation (CWE-770).

The vulnerability affects any application that imports and uses the golang.org/x/image/font/sfnt package, including all versions of the golang.org/x/image library prior to a patch, regardless of the Go runtime version. No specific product versions are listed in the CNA data, so all unpatched instances are potentially impacted.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of < 1% (0.00013) shows a low probability that this flaw will be exploited. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting no publicly known exploits yet. The likely attack vector involves an attacker providing a specially crafted font file to an application that processes fonts; this is inferred because the vulnerability is triggered during font parsing.