Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-23865

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsin

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Meta

Description

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeType FreeType

Default version status: affected

  • 2.13.2 to ≤ 2.13.3affected
  • 2.14.0 to ≤ 2.14.1affected

References