Vulnerabilities

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.

FreeType, the widely bundled open-source font rendering library, contains an out-of-bounds write (CWE-787) when parsing subglyph structures in TrueType GX and variable font files. The flaw is triggered when an application using FreeType renders a specially crafted font file, such as one embedded in a document, webpage, or downloaded file. A successful exploit may allow the attacker to execute arbitrary code with the privileges of the application that processed the font. Because FreeType ships by default with virtually all major Linux distributions, Android, and many applications and embedded products, the affected population is extremely broad, though specific affected version ranges are not enumerated in the available data. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on 2025-05-06, indicating confirmed in-the-wild exploitation, and carries a high EPSS probability of 27.8% (98th percentile); no public proof-of-concept code is known.

Do: Update FreeType to the latest available release/commit and apply vendor patches for any product that bundles or depends on it, since exact vulnerable version ranges are not stated in the available data. Inventory your environment for software, operating systems, and dependencies that ship FreeType, and prioritize internet-facing or user-facing systems that process untrusted font files. Federal agencies must follow the CISA KEV required action (apply vendor mitigations per BOD 22-01) or discontinue use if mitigations are unavailable.

FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.

Google Chrome bundles the open-source FreeType library for font rendering, and that library contains a heap buffer overflow (CWE-787, out-of-bounds write) in its Load_SBit_Png function. The flaw is triggered when the browser loads a crafted font containing a malicious PNG image embedded as embedded bitmap data, typically from a web page the victim visits, corrupting heap memory with attacker-controlled data. Successful exploitation can crash the browser or execute code in the renderer, and it was used in the wild as part of an exploit chain combined with CVE-2020-17087 (Windows kernel) and CVE-2020-16010 (Android) to escape the sandbox. Anyone running an affected Google Chrome release that ships the vulnerable FreeType code, across Windows, macOS, Linux, Chrome OS and Android, is affected, meaning effectively the entire Chrome install base at the time of disclosure. The vulnerability is confirmed exploited in the wild (listed in CISA's KEV catalog, added 2021-11-03; ransomware use unknown), Google patched it in Chrome 86.0.4240.111, no public proof-of-concept is known, and EPSS estimates a 44.3% probability of exploitation within 30 days (99th percentile).

Do: Update Google Chrome to 86.0.4240.111 or later (any current stable-channel release satisfies this), and where other software bundles FreeType directly, update to FreeType 2.10.4 or later per the upstream fix. Because the bug was chained with CVE-2020-17087 on Windows and CVE-2020-16010 on Android, also apply the corresponding Microsoft Windows and Android updates to close the sandbox-escape chain. Use endpoint management to inventory browser versions and confirm no endpoints remain below the fixed release, as required by the CISA KEV catalog.

An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file.

FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c.

FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.

FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.

The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.