EUVD-2026-74023
GHSA-xv99-644v-jp6p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious font file
-
DeliveryDeliver via auto-rendered content
-
ExploitTrigger improper cast in ftsmooth.c
-
ExecutionCorrupt rasterizer memory
-
ImpactExecute arbitrary code on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Correct type conversion
|
| Exploitation Conditions | Exploitation requires the target Android device (version 14, 15, 16, 16-qpr2, or 17) to process an attacker-crafted font through FreeType's smooth/anti-aliased rendering path in ftsmooth.c. Per the bulletin, no additional execution privileges and no user interaction are required, implying a rendering context that automatically parses attacker-supplied font data (e.g., auto-rendered message, web, or document content). The practical limiting factor is delivery: the attacker must get malicious font data into a path that Android renders, and the device must not yet have the 2026-09-01 (or later) security patch level applied. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) reflects an unauthenticated, no-interaction RCE, and the CWE-704 memory-safety class in a font parser is a historically reliable exploitation target. However, signals are mixed: SSVC records Exploitation as 'none' (no observed or public exploitation), while flagging Automatable:yes and Technical Impact:total - meaning that although exploitation is not yet occurring, a working exploit could scale broadly. There is no KEV listing, no POC, and no EPSS score in the input, so this is currently a high-severity-but-not-yet-exploited issue rather than an active-attack emergency. The 'user interaction not needed' claim is notable and slightly optimistic for a font bug - real triggering usually depends on the platform auto-rendering attacker-supplied font data (e.g., via a message, web content, or document preview), which any mid-sized municipal or enterprise IT team should nonetheless treat as urgent given Android's massive footprint and the total technical impact. Overall: prioritize patching promptly, but active-exploitation panic is not currently warranted. |
| Exploit ScenarioDerived | An attacker crafts a malicious font file and delivers it through a channel that Android auto-renders - for example an embedded font in a webpage, message, or document preview. When the FreeType smooth rasterizer processes the font, the improper cast in ftsmooth.c corrupts memory, allowing the attacker to execute arbitrary code at the privilege level of the rendering process with no user interaction. No public POC currently exists, but SSVC rates the flaw automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Remote code execution in Android (versions 14 through 17) arises from improper type casting in multiple functions of ftsmooth.c, the anti-aliased smooth rasterizer of the bundled FreeType font-rendering engine. An attacker can trigger memory corruption through a maliciously crafted font with no user interaction and no additional execution privileges, per the September 2026 Android Security Bulletin. There is no public exploit identified at time of analysis; CISA SSVC lists exploitation status as none but rates the flaw automatable with total technical impact.
RemediationAI
Apply the Android security update corresponding to the 2026-09-01 patch level or later on all affected devices (Android 14 through 17); the fix is delivered via the monthly Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-09-01. A specific FreeType release version is not enumerated in the provided data, so verify the device patch-level string rather than a library version number - install the OEM/carrier OTA that reports the September 2026 (or newer) security patch level. As a compensating control until patched, restrict processing of untrusted fonts: avoid opening documents, web pages, or messages from untrusted sources that could embed custom fonts, and where enterprise MDM allows, disable or sandbox applications that auto-render remote font/document content - the trade-off is reduced functionality in messaging, browsing, and document-preview features. No standalone workaround from the vendor is documented in the input.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable file ftsmooth.c belongs to FreeType, the ubiquitous open-source font-rendering library embedded in the Android system and used across the OS for glyph rasterization. The root cause is CWE-704 (Incorrect Type Conversion or Cast): improper casting during smooth (anti-aliased) rendering leads to memory being interpreted or sized incorrectly, producing an exploitable memory-safety condition (typically out-of-bounds access or heap corruption). Because font parsing runs in privileged media/system rendering paths, a casting error there yields a high-value RCE primitive reachable whenever a malicious font is processed.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Memory-safety RCE in a system font parser reachable without privileges or user interaction and delivered via network-borne content yields full CIA impact.
Primary rating from Vendor (android).
CVSS VectorVendor: android
DescriptionCVE.org
In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 1
Executive ViewAI
Google Android versions 14 through 17 contain a critical remote code execution vulnerability in the FreeType font-rendering engine that requires no user interaction to exploit. No vendor patch is currently available, leaving millions of organizational devices at immediate risk of complete compromise and data exfiltration.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict all font loading to only pre-installed system fonts; disable auto-download and auto-install features for font files in all applications; implement network-level file-type filtering to block font files from external sources; establish detailed logging and alerting on font-rendering engine process activity for threat detection; consider temporary isolation or air-gapping of devices handling sensitive data until a patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB