This vulnerability involves the golang.org/x/image/font/sfnt package improperly handling memory allocation sizes when parsing font files. Specifically, a maliciously crafted font file can cause the software to allocate an excessive amount of memory, potentially leading to denial of service or application instability. The issue is identified as CWE-789 (Memory Allocation with Excessive Size Value). There is no CVSS score or vendor advisory indicating a fix or mitigation at this time.

The primary impact is the potential for denial of service or application crashes due to excessive memory consumption when processing malicious font files. No known exploits have been reported, and the vulnerability does not indicate direct code execution or data corruption beyond resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding processing untrusted font files with the affected package or implement external memory usage controls if possible.