An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TTGetVarDesign implementation used by FTGetVarDesignCoordinates
Project Zero today made four bugs in FreeType publicly visible.
Fixes appears to have been committed to FreeType's git repo, but no new release made yet, and no CVE id's are listed in the bug reports or commits.
Each individual bug report, on either the Project Zero tracker or the FreeType gitlab, has more details, including technical analysis, reproducers, and suggested fixes from the researchers.
------------------------------------------------------------------------------
FreeType: Heap Buffer Overflow via Improper Limit Calculation in TrueType SHZ Instruction https://project-zero.issues.chromium.org/issues/505355061
Vulnerability Type: Heap Buffer Overflow (Read/Write) Affected Component: TrueType Bytecode Interpreter (ttinterp.c) Affected Versions: Confirmed on v2.14.3 and git head (f2b3f969) Credit: Mateusz Jurczyk of Google Project Zero
A heap buffer overflow vulnerability exists in the FreeType library's TrueType bytecode interpreter. The vulnerability is triggered by the SHZ (Shift Zone) instruction when executed within a composite glyph context. Improper calculation of the loop limit leads to an out-of-bounds memory access (both read and write) in the MoveZp2Point function. An attacker can leverage this to cause an application crash or potentially achieve arbitrary code execution.
Reported at: https://gitlab.freedesktop.org/freetype/freetype/-/workitems/1420 Fixed by https://gitlab.freedesktop.org/freetype/freetype/-/commit/1803559c4ee407d0bcbf2a67dbe96690cee869d2 and several follow-up commits.
------------------------------------------------------------------------------
FreeType: Integer Overflow leading to Out-of-Bounds Read in TrueType IUP Instruction https://project-zero.issues.chromium.org/issues/505357209
Vulnerability Type: Integer Overflow / Out-of-Bounds Read / Denial of Service Affected Component: TrueType Bytecode Interpreter (ttinterp.c) Affected Versions: Confirmed on v2.14.3 and git head (f2b3f969) Credit: Mateusz Jurczyk of Google Project Zero
An integer overflow vulnerability exists in the FreeType library's TrueType bytecode interpreter's handling of the IUP (Interpolate Untouched Points) instruction. By using a signed 16-bit integer for a loop counter that iterates over glyph contours, the interpreter can be forced into an infinite loop or an out-of-bounds read if a glyph contains more than 32,767 contours. This leads to a Denial of Service (DoS) and potential information leakage.
Reported at: https://gitlab.freedesktop.org/freetype/freetype/-/workitems/1421 Fixed in https://gitlab.freedesktop.org/freetype/freetype/-/commit/7974be74d8b5a2fbf99aa88f0461d1f80af51cee.
------------------------------------------------------------------------------
FreeType: Heap Buffer Overflow via Signedness Mismatch in TrueType Variation Handling (ttinterpolatedeltas) https://project-zero.issues.chromium.org/issues/506902245
Vulnerability Type: Heap Buffer Overflow / Integer Wrap-around Affected Component: TrueType Variation Handling (ttgxvar.c) Affected Versions: Confirmed on v2.14.3 and git head (5d109934) Credit: Mateusz Jurczyk of Google Project Zero
A heap-based buffer overflow vulnerability exists in FreeType 2.14.3 when processing composite glyphs in variable fonts. The flaw is caused by a signed 16-bit integer wrap-around in a loop counter within the variation delta interpolation logic. An attacker can leverage this by providing a font with a composite glyph containing more than 32,767 components, leading to out-of-bounds memory access. This vulnerability can potentially result in arbitrary code execution in applications that use FreeType to process untrusted font files.
Reported in https://gitlab.freedesktop.org/freetype/freetype/-/workitems/1423. Fixed in https://gitlab.freedesktop.org/freetype/freetype/-/commit/0d45c7f1911bc6db0bf072eea0c8cdccd77bc6b3.
------------------------------------------------------------------------------
FreeType: Heap Buffer Over-read in ttfacecolrblendlayer via Sub-byte Bitmaps
Vulnerability Type: Heap Buffer Over-read / Information Disclosure Affected Component: COLR v0 Blending (ttcolr.c) Affected Versions: Confirmed on v2.14.3 and git head (5d109934) Credit: Mateusz Jurczyk of Google Project Zero
A heap-based buffer over-read vulnerability exists in FreeType 2.14.3's COLR v0 layer blending function ttfacecolrblendlayer. When a COLR v0 base glyph references a layer glyph backed by an embedded bitmap with a sub-byte pixel mode (1bpp MONO, 2bpp GRAY2, or 4bpp GRAY4), the blending loop incorrectly treats the source bitmap as 8-bit grayscale. This causes the function to read beyond the end of the heap-allocated packed bitmap buffer. The over-read data is directly encoded into the output pixel values, allowing for potential information disclosure of heap memory bytes in applications that process untrusted font files.
Reported in https://gitlab.freedesktop.org/freetype/freetype/-/workitems/1425 Fixed in https://gitlab.freedesktop.org/freetype/freetype/-/commit/cbe12767ea73d1006edc75fcd61c0b0d2a88f34e.
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Hello oss-security,
This is an information-only post documenting a downstream impact and maintainer response for an existing, already-public CVE.
== CVE == CVE-2025-27363 -- FreeType <= 2.13.2 heap-buffer-overflow in loadtruetypeglyph(), src/truetype/ttgload.c (~line 1929). NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-27363 Fix: FreeType 2.13.3, upstream commit a1e5a9df.
== Downstream impact: FontForge == FontForge (https://github.com/fontforge/fontforge) links FreeType to parse and process font files. When built or run against FreeType <= 2.13.2, FontForge inherits the heap-buffer-overflow when opening a maliciously crafted TrueType font.
We confirmed the issue with AddressSanitizer against FreeType 2.13.0 (common in distributions that have not backported the fix):
==ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 16 at ttgload.c:1929 in loadtruetypeglyph 0 bytes to the right of 16-byte region allocated at ttgload.c:1909
Recommended action for distributors and packagers: ensure FontForge is built/linked against FreeType >= 2.13.3, or apply the upstream fix (commit a1e5a9df).
== Upstream maintainer response == We reported this downstream impact to FontForge upstream as https://github.com/fontforge/fontforge/issues/5799 (2026-04-15). The issue was closed within hours under "Community-guidelines #D1", which states that the project does not accept security reports without an accompanying fix PR.
Context: ZDI submitted 12 unrelated FontForge CVEs in 2025-12 and received the same response (https://github.com/fontforge/fontforge/issues/5706).
We post here so distributors and downstream packagers have a public, independent record of the FontForge -> FreeType linkage status, and can verify their own builds.
== Reproducer == Public PoC: https://github.com/francozappa/poc-CVE-2025-27363 Build/run FontForge against FreeType 2.13.0 or 2.13.2 with the PoC TTF to reproduce.
Regards, vulgraph (Academic security research; PhD work on 1-day vulnerability propagation across forks and downstream consumers.)
While the announcement below says "A bunch of potential security problems have been found. All users should update." the Meta CNA has issued CVE-2026-23865, stating: An integer overflow in the ttvarloaditemvariationstore function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.
Affected Version Information:
FreeType (FreeType) Default Status: affected affected from 2.13.2 through 2.13.3 affected from 2.14.0 through 2.14.1
References:
https://gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c https://sourceforge.net/projects/freetype/files/freetype2/2.14.2/ -------- Forwarded Message -------- Subject: Announcing FreeType 2.14.2 Date: Sun, 1 Mar 2026 20:46:54 +0000 From: Werner LEMBERG <wl () gnu org> To: freetype-announce () nongnu org, freetype () nongnu org, freetype-devel () nongnu org
FreeType 2.14.2 has been released.
It is available from
https://savannah.nongnu.org/download/freetype/
or
https://sourceforge.net/projects/freetype/files/
The latter site also holds older versions of the FreeType library.
See below for the relevant snippet from the CHANGES file.
Enjoy!
Werner
PS: Downloads from savannah.nongnu.org will redirect to your nearest mirror site. Files on mirrors may be subject to a replication delay of up to 24 hours. In case of problems use https://download-mirror.savannah.gnu.org/releases/
----------------------------------------------------------------------
https://www.freetype.org
FreeType 2 is a software font engine that is designed to be small, efficient, highly customizable, and portable while capable of producing high-quality output (glyph images) of most vector and bitmap font formats.
Note that FreeType 2 is a font service and doesn't provide APIs to perform higher-level features, like text layout or graphics processing (e.g., colored text rendering, 'hollowing', etc.). However, it greatly simplifies these tasks by providing a simple, easy to use, and uniform interface to access the content of font files.
FreeType 2 is released under two open-source licenses: our own BSD-like FreeType License and the GPL. It can thus be used by any kind of projects, be they proprietary or not.
----------------------------------------------------------------------
You can use a .sig file to verify that the corresponding file (without the .sig suffix) is intact. First, be sure to download both the .sig file and the corresponding archive. Then, run a command like this:
gpg --verify freetype-2.14.2.tar.gz.sig
If that command fails because you don't have the required public key, execute
gpg --keyserver pgp.mit.edu --recv-keys BE6C3AAC63AD8E3F
to import it, then rerun the gpg --verify command.
SHA1 file checksums:
ad090dafb29135d08665eba400a1b1b66edd7313 freetype-2.14.2.tar.gz 28200b8f8df5a524f476bdacb20f05da1c33280c freetype-2.14.2.tar.xz cde32902a8bffed4c855570bc86a2584fa373ff8 ft2142.zip dac409e7009221f14b9367d4581d54a895bfe624 ft2demos-2.14.2.tar.gz cccaa9ec2e4327901fafd6e830885dc9131d9c2d ft2demos-2.14.2.tar.xz c04d9c5ef4d929185c01d5f63162a4656578fd14 ftdmo2142.zipA bunch of potential security problems have been found. All users should update. aca81e3c7bb5793b957c2d4ff61e58ad726b00a5 freetype-doc-2.14.2.tar.gz adf5448cb668073545ba87b23cff21a08b56d3de freetype-doc-2.14.2.tar.xz 4eeadfe25683500562a31f38920a24867e178f52 ftdoc2142.zip
SHA256 file checksums:
752c2671f85c54a84b7f0dd2b5cd26b6b741117033886ffbc5ac89a68464b848 freetype-2.14.2.tar.gz 4b62dcab4c920a1a860369933221814362e699e26f55792516d671e6ff55b5e1 freetype-2.14.2.tar.xz ad3aed6fa521148de639aceb6ac7db25554c68ee122f086232dd33a327175eb1 ft2142.zip fd63fabb75302b71a33f97dbf14e658309985569ed0eaac6355dd8862db65ff2 ft2demos-2.14.2.tar.gz ae9ed4b095e73a3fbdb90363c138ea62ac4b0f55aa4bb345b9b2458783f9284f ft2demos-2.14.2.tar.xz 94f7ecdd05720bde3f15feae9bbf1e885640e97c06efc75c4badaaa6691a0b06 ftdmo2142.zip 5bf511f318256991d3fbe056f0a3fdb191c601c93f079edc7a4ee746e91ec1de freetype-doc-2.14.2.tar.gz 0514edfd6a7b480f753aa48789d7112038a218b0b06afdca320c4bcbc2f66e6b freetype-doc-2.14.2.tar.xz d43d0ce570c8204299d35982b8eb66660d9bb945dbfbd1a00194f30c1225301d ftdoc2142.zip
CHANGES BETWEEN 2.14.1 and 2.14.2 (2026-Mar-01)
I. IMPORTANT CHANGES
- Several changes related to LCD filtering are implemented to achieve better performance and encourage sound practices.
. Instead of blanket LCD filtering over the entire bitmap, it is now applied only to non-zero spans using direct rendering. This speeds up the ClearType-like rendering by more than 40% at sizes above 32 ppem.
. Setting the filter weights with FTFaceProperties is no longer supported. The default and light filters are optimized to work with any face.
. The legacy libXft LCD filter algorithm is no longer provided.
II. IMPORTANT BUG FIXES
- A bunch of potential security problems have been found. All users should update.
- The italic angle in PSFontInfo is now stored as a fixed-point value in degrees for all Type 1 fonts and their derivatives, consistent with CFF fonts and common practices. The broken underline position and thickness values are fixed for CFF fonts.
III. MISCELLANEOUS
- The x field in the FTSpan structure is now unsigned.
- Demo program ftgrid got an option -m to select a start character to display.
- Similarly, demo program ftmulti got an option -m to select a text string for rendering.
- Option -d in the demo program ttdebug is now called -a, expecting a comma-separated list of axis values. The user interface is also slightly improved.
- The ftinspect demo program can now be compiled with Qt6, too.
An integer overflow in the ttvarloaditemvariationstore function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.
An integer overflow in the ttvarloaditemvariationstore function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
Impact A memory corruption bug(Heap overflow) in the FreeType font rendering library.
This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images .
As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/
Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild.
Patches Upgrade to 85.3.130 or higher
References - https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/ - https://www.zdnet.com/article/google-releases-chrome-security-update-to-patch-actively-exploited-zero-day/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15999 - https://magpcss.org/ceforum/viewtopic.php?f=10&t=17942
To review the CEF/Chromium patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d
An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the InsGETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file.
FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1decoderparsecharstrings function in psaux/t1decode.c.
The (1) t1parsefontmatrix function in type1/t1load.c, (2) cidparsefontmatrix function in cid/cidload.c, (3) t42parsefontmatrix function in type42/t42parse.c, and (4) psparserloadfield function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted font.
The t42parseencoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.
The parseencoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.
bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.
Array index error in the parsefond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file.
Integer signedness error in the MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.
Multiple integer signedness errors in the pcfgetencodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row.
sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table.
The MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.
The ttcmap4validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.
The bdfparseglyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.
Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table.
FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c.
Off-by-one error in the pcfgetproperties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.
The ttsbitdecoderinit function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.
cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font.
The ttsbitdecoderloadimage function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font.
cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2240.
The LoadSBitPng function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file.
The ttfaceloadhdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.