CVE-2026-58822

CVE-2026-58822 is a memory-safety vulnerability in the FreeType font rendering library's smooth rasterizer (source file ftsmooth.c), caused by improper type casting (CWE-704) across multiple functions. It is triggered when the library processes attacker-controlled font data, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates it is reachable over a network without authentication or user interaction, which matters most for network-facing services that render untrusted fonts. A successful attacker gains remote code execution with no privileges required, with high impact on confidentiality, integrity, and availability. Anyone running software that bundles the affected FreeType code is exposed, and because FreeType ships in Android and most Linux distributions as well as countless applications and embedded devices, the plausibly affected install base is very large, though the affected version range is not specified in the available data. There is no known public proof-of-concept, the flaw is not in CISA's KEV, and its EPSS score of 0.3% (23rd percentile) suggests low expected exploitation in the next 30 days.

What to do: No fixed version is specified in the available data, so monitor the FreeType project and Google/Android security bulletins for the patched release and update bundled or vendored copies of FreeType as soon as one is published. In the meantime, identify network-facing services that parse untrusted font files (e.g., document, PDF, image, or web-font rendering services) and sandbox or restrict that parsing, since exploitation requires no authentication or user interaction.