freetype · threatengine.sh

CVE-2026-23865

>= 2.13.2 and <= 2.13.3

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may all

5.3MEDIUM

CVE-2025-27363

<= 2.13.0

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attemptin

8.1HIGH

CVE-2025-23022

all versions

FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

4.0MEDIUM

CVE-2022-27406

< 2.12.0

FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Re

7.5HIGH

CVE-2022-27405

< 2.12.0

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_S

7.5HIGH

CVE-2022-27404

< 2.12.0

FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_in

9.8CRITICAL

CVE-2020-15999

>= 2.6.0 and < 2.10.4

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap cor

9.6CRITICAL

CVE-2015-9383

< 2.6.2

FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.

6.5MEDIUM

CVE-2015-9382

< 2.6.1

FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an

6.5MEDIUM

CVE-2015-9381

< 2.6.1

FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.

8.8HIGH

CVE-2015-9290

< 2.6.1

In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check tha

9.8CRITICAL

CVE-2018-6942

<= 2.9

An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c

6.5MEDIUM

CVE-2017-8287

<= 2.7.1

FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_con

9.8CRITICAL

CVE-2017-8105

< 2.7.1

FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_cha

9.8CRITICAL

CVE-2017-7864

<= 2.7.1

FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset functi

9.8CRITICAL

CVE-2017-7858

<= 2.7.1

FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_i

9.8CRITICAL

CVE-2017-7857

>= 2.7 and < 2.8

FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var functi

9.8CRITICAL

CVE-2016-10328

<= 2.7

FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run funct

9.8CRITICAL

CVE-2016-10244

< 2.7.1

The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which

7.8HIGH

CVE-2014-9747

<= 2.5.3

The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for im

7.5HIGH

CVE-2014-9746

<= 2.5.3

The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in cid/cidload.c, (3) t42_parse_font_m

9.8CRITICAL

CVE-2014-9745

<= 2.5.2

The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infin

CVE-2014-9675

<= 2.5.3

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allo

CVE-2014-9674

<= 2.5.3

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without valida

CVE-2014-9673

<= 2.5.3

Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers

CVE-2014-9672

<= 2.5.3

Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of

CVE-2014-9671

<= 2.5.3

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a d

CVE-2014-9670

<= 2.5.3

Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attack

CVE-2014-9669

<= 2.5.3

Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-b

CVE-2014-9668

<= 2.5.3

The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting

CVE-2014-9667

<= 2.5.3

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remot

CVE-2014-9666

<= 2.5.3

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without rest

CVE-2014-9665

<= 2.5.3

The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, whi

CVE-2014-9664

<= 2.5.3

FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to caus

CVE-2014-9663

<= 2.5.3

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's valu

CVE-2014-9662

<= 2.5.3

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attack

CVE-2014-9661

<= 2.5.3

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which al

CVE-2014-9660

<= 2.5.3

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which a

CVE-2014-9659

<= 2.5.3

cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has b

CVE-2014-9658

<= 2.5.3

The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows

CVE-2014-9657

<= 2.5.3

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allo

CVE-2014-9656

<= 2.5.3

The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow,

CVE-2014-2241

<= 2.5.2

The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not prop

CVE-2014-2240

<= 2.5.2

Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers t

CVE-2012-5670

<= 2.4.10

The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (out-of-b

CVE-2012-5669

<= 2.4.10

The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) a

CVE-2012-5668

<= 2.4.10

FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via ve

CVE-2012-1144

<= 2.4.8