Skip to main content

FreeType CVE-2026-50811

| EUVDEUVD-2026-42157 MEDIUM
Out-of-bounds Read (CWE-125)
2026-07-07 mitre GHSA-v5fr-wv7c-jq2m
Buffer Overflow Information Disclosure Red Hat N A Suse
6.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
vuln.today AI
6.5 MEDIUM

Network vector valid for server-side font processors; no auth or interaction needed; impact bounded to partial read and limited availability per CWE-125.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Red Hat
7.1 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

3
Analysis Generated
Jul 08, 2026 - 20:54 vuln.today
CVSS changed
Jul 08, 2026 - 20:22 NVD
6.5 (MEDIUM)
CVE Published
Jul 07, 2026 - 00:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates

AnalysisAI

Out-of-bounds read in FreeType 2.14.3 exposes partial heap memory and risks process crashes when processing crafted variable fonts via the TT_Get_Var_Design code path. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects server-side or automated font processing pipelines where untrusted font data reaches FT_Get_Var_Design_Coordinates without authentication barriers. No active exploitation is confirmed in CISA KEV; however, a researcher-published gist suggests working proof-of-concept material exists, and EPSS at 0.17% (7th percentile) indicates minimal observed exploitation activity to date.

Technical ContextAI

FreeType is a mature open-source font rendering engine deeply embedded in Linux, Android, and browser stacks via libfreetype. The vulnerable code resides in src/truetype/ttgxvar.c within TT_Get_Var_Design, which is the internal implementation called by the public API function FT_Get_Var_Design_Coordinates. This function handles OpenType Font Variations (variable fonts), which encode multiple design axes (weight, width, etc.) as parametric coordinates. CWE-125 (Out-of-Bounds Read) indicates the parser reads beyond the boundary of an allocated array - likely when parsing malformed axis records or coordinate arrays in a crafted variable font. The fix is pinned to commit 5a280ecde6f324de0d226261036e736e0cb49a71 on both the canonical FreeType GitLab repository and its GitHub mirror. CPE data in NVD is listed as 'n/a' and is not populated, so exact version ranges must be confirmed from the upstream issue tracker at https://gitlab.freedesktop.org/freetype/freetype/-/issues/1436.

RemediationAI

The upstream fix is committed at https://gitlab.freedesktop.org/freetype/freetype/-/commit/5a280ecde6f324de0d226261036e736e0cb49a71 and mirrored at https://github.com/freetype/freetype/commit/5a280ecde6f324de0d226261036e736e0cb49a71. A released patched version number is not confirmed in the available data - only the commit hash is known - so downstream package maintainers and users should verify that their distribution's FreeType package incorporates this commit. Upstream fix available (commit); released patched version not independently confirmed. As compensating controls for environments that cannot patch immediately: restrict font input pipelines to trusted, pre-validated font sources; consider disabling variable font processing if the application does not require OpenType Font Variations support, noting that this would break rendering for variable fonts. Monitor distribution advisories (Debian, Ubuntu, Red Hat, Alpine) for patched package releases. Reference the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-50811 and ENISA EUVD-2026-42157 for downstream advisory updates.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.180 Affected
SUSE Linux Micro 6.2 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-50811 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy