CVE-2026-95512

A resource-consumption flaw (CWE-400) in FreeType's CID font loader lets a specially crafted CID-keyed font force repeated allocations and decryptions of subroutine data across multiple font dictionaries. A remote attacker triggers it by tricking a user or service into opening content that embeds or references that font, which can exhaust memory and CPU until the process hangs or exits. Impact is denial of service only (CVSS 3.1 5.5: local vector, user interaction required, high availability impact, no confidentiality or integrity loss). Any application or OS component that renders fonts with a vulnerable FreeType build is in scope, including desktops, browsers, and server-side document pipelines that handle untrusted fonts. No public proof of concept is known and the CVE is not in CISA KEV.

What to do: Install the FreeType update your vendor ships for this issue; the related announcement is FreeType 2.15.0, so confirm that build or a later patched package is what you deploy. Until then, do not open untrusted documents or web content that embed CID-keyed fonts, and cap memory and CPU (or sandbox) any service that renders user-supplied fonts so one job cannot hang or kill the host.