CVE-2026-50811
Published: July 7th, 2026
An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates
MEDIUM
CVSS v3: 6.5
CVSS v3: 6.5
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | freetype (2.13.3) | Not Affected | Code Not Present | The out-of-bounds read is caused by the trailing loop in TT_Get_Var_Design (src/truetype/ttgxvar.c) that fills excess requested coordinates with axis defaults via for ( ; i < num_coords; i++, a++ ) coords[i] = a->def;, advancing the axis pointer a past the blend->num_axis-element mmvar->axis array. This pattern was introduced upstream after 2.13.3 and does not exist in FreeType 2.13.3. Our TT_Get_Var_Design zero-fills excess coordinates (for ( ; i < num_coords; i++ ) coords[i] = 0;) and never dereferences the axis pointer beyond blend->num_axis, so FT_Get_Var_Design_Coordinates cannot trigger the out-of-bounds read. The upstream fix commit 5a280ecde6f324de0d226261036e736e0cb49a71 replaces the axis-default fill with zeroing, behavior our version already exhibits. |
| 26.2 | freetype (2.13.3) | Needs Triage | ||
| 26.1 | freetype (2.13.3) | Needs Triage | ||
| 25.4 | freetype (2.13.3) | Needs Triage | ||
| 25.3 | freetype (2.13.3) | Needs Triage | ||
| 25.2 | freetype (2.13.3) | Needs Triage | ||
| 25.1 | freetype (2.6.5) | Needs Triage | ||
| 24.4 | freetype (2.6.5) | Needs Triage | ||
| 24.4.0 | freetype (2.6.5) | Needs Triage | ||
| 24.3 | freetype (2.6.5) | Needs Triage | ||
| 24.2 | freetype (2.6.5) | Needs Triage | ||
| 24.1 | freetype (2.6.5) | Needs Triage | ||
| 23.3 | freetype (2.6.5) | Needs Triage | ||
| 23.2 | freetype (2.6.5) | Needs Triage | ||
| 23.1 | freetype (2.6.5) | Needs Triage | ||
| 22.4 | freetype (2.6.5) | Needs Triage | ||
| 22.3 | freetype (2.6.5) | Needs Triage | ||
| 22.2 | freetype (2.6.5) | Needs Triage | ||
| 22.1 | freetype (2.6.5) | Needs Triage | ||
| 21.11 | freetype (2.6.5) | Needs Triage | ||
| 21.8 | freetype (2.6.5) | Needs Triage |
Severity score breakdown
Attack Complexity
LOW
Attack Vector
NETWORK
Availability Impact
LOW
Base Score
6.5
Base Severity
MEDIUM
Confidentiality Impact
LOW
Integrity Impact
NONE
Privileges Required
NONE
Scope
UNCHANGED
User Interaction
NONE
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Version
3.1