An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNTSizeRequest.

FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FTRequestSize.

FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TTGetMMVar function in truetype/ttgxvar.c and the sfntinitface function in sfnt/sfobjs.c.

FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TTGetMMVar function in truetype/ttgxvar.c and the sfntinitface function in sfnt/sfobjs.c.

FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the ttsizereset function in truetype/ttobjs.c.

Stack-based buffer overflow in the cf2hintmapbuild function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.

The parsecharstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.

Hi Michel,

On 2025-03-13 22:54, Michel Lind wrote: The fixes I'm working with both the Meta security folks and the EL community (CentOS / AlmaLinux) can be tracked herehttps://gitlab.com/redhat/centos-stream/rpms/freetype/-/mergerequests/8/diffs

https://gitlab.freedesktop.org/freetype/freetype/-/commit/47103b2f195e0f9664c9470182f063cb7d41dc9f -- a/src/truetype/ttgload.c +++ b/src/truetype/ttgload.c @@ -1957,6 +1957,13 @@

limit = (short)gloader->current.numsubglyphs;

+ / make sure this isn't negative as we're going to add 4 later / + if ( limit < 0 ) + { + error = FTTHROW( InvalidArgument ); + goto Exit; + } + / construct an outline structure for / / communication with TTVaryApplyGlyphDeltas' / outline.npoints = (short)( gloader->current.numsubglyphs + 4 );

Marc.

I don't know much about this bug, which seems to have been announced by Facebook yesterday.

https://nvd.nist.gov/vuln/detail/CVE-2025-27363 An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild. The latest version of FreeType is 2.13.3 which is NOT affected, according to the announcement. Recent distro versions (e.g. Ubuntu 24.04 with 2.13.2) also look safe.

However, older distro versions seem to have affected libraries. For example Debian Bookworm has "2.12.1+dfsg-5+deb12u3", which is less than "2.13.0".

The bug would not be too concerning if people only used trusted fonts, as used to be routine. But webpages now embed fonts, and the affected "variable font files" format is widely used in browsers. It allows parametric adjustment of font properties, described here:

https://developer.mozilla.org/en-US/docs/Web/CSS/CSSfonts/Variablefontsguide

However, it looks like the browsers themselves might be embedding unaffected recent versions of FreeType. For example, I see Mozilla have a commit with the message: Bug 1912903 - Update freetype2 to 2.13.3. https://github.com/mozilla/gecko-dev/commit/026f6a947085020cd189dd9af3da00be433a44f8

I know there's some tension between bundling and unbundling tendencies in the packaging of browsers, so I am not sure how exposed anyone is.

Anyway, I don't see patches for 2.11.x and 2.12.x in stable/LTS releases, and the FreeType website seems pretty quiet about this.

Douglas

FreeType 2.8.1 has a signed integer overflow in cf2doFlex in cff/cf2intrp.c.

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfntinitface.

Integer overflow in FreeType before 2.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PCF file, as demonstrated by the Red Hat bad1.pcf test file, due to a partial fix of CVE-2006-1861.

Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to (1) bdf/bdflib.c, (2) sfnt/ttcmap.c, (3) cff/cffgload.c, and (4) the readlwfn function and a crafted LWFN file in base/ftmac.c. NOTE: item 4 was originally identified by CVE-2006-2493.

Integer underflow in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a font file with an odd number of blue values, which causes the underflow when decrementing by 2 in a context that assumes an even number of values.

The ftbitmapassurebuffer function in src/base/ftbimap.c in FreeType 2.3.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors involving bitmap fonts, related to a "memory buffer overwrite bug."

Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative npoints value, which leads to an integer overflow and heap-based buffer overflow.

Integer overflow in FreeType2 before 2.3.6 allows context-dependent attackers to execute arbitrary code via a crafted set of 16-bit length values within the Private dictionary table in a Printer Font Binary (PFB) file, which triggers a heap-based buffer overflow.

FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "number of axes" field in a Printer Font Binary (PFB) file, which triggers a free of arbitrary memory locations, leading to memory corruption.

Multiple off-by-one errors in FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via (1) a crafted table in a Printer Font Binary (PFB) file or (2) a crafted SHC instruction in a TrueType Font (TTF) file, which triggers a heap-based buffer overflow.

Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.

Heap-based buffer overflow in the InsSHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font.

Buffer overflow in the ftvarreadpackedpoints function in truetype/ttgxvar.c in FreeType 2.4.3 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TrueType GX font.

Integer overflow in base/ftstream.c in libXft (aka the X FreeType library) in FreeType before 2.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Compact Font Format (CFF) font file that triggers a heap-based buffer overflow, related to an "input stream position error" issue, a different vulnerability than CVE-2010-1797.

Unspecified vulnerability in FreeType 2.3.9, and other versions before 2.4.2, allows remote attackers to cause a denial of service via vectors involving nested Standard Encoding Accented Character (aka seac) calls, related to psaux.h, cffgload.c, cffgload.h, and t1decode.c.

bdf/bdflib.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) via a crafted BDF font file, related to an attempted modification of a value in a static string.

Heap-based buffer overflow in the InsIUP function in truetype/ttinterp.c in FreeType before 2.4.0, when TrueType bytecode support is enabled, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.