The original fix for CVE-2025-30749 was found to be incomplete. In particular, the CGGlyphImagesGetGlyphImagePtrs method incorrectly calculates pointers to the arrays inside the pre-allocated buffer. It caused out-of-memory access and crash.
The HTTP client leaks sensitive information when redirecting to a different domain.
Several scenarios of heap corruption were observed for Graphics2D.drawString(String,float,float) with varying settings for RenderingHints and affine font transformations.