FreeType EUVD-2026-91327

Exploitation requires FreeType's CID font loader to process an attacker-supplied, specially crafted CID-keyed font - delivered by embedding or referencing it in content (e.g., a document or web page) that the victim opens. The attack is gated by required user interaction (UI:R): a user or an automated service must actually load and parse the malicious font; it cannot be triggered unsolicited against an idle host. Impact is limited to denial of service (application hang/termination) with no confidentiality or integrity effect. Realistic risk is highest for automated, unattended font/document-processing pipelines (rendering, conversion, or thumbnailing services) that parse untrusted input, and lower for interactive desktop use where a human initiates each open. Any application or service that does not use FreeType for CID-keyed font parsing is unaffected.

This is a moderate, availability-only issue (CVSS 5.5, A:H with C:N/I:N) best characterized as a resource-exhaustion denial of service rather than a code-execution threat. The CVSS vector marks it AV:L/AC:L/PR:N/UI:R/S:U: the 'local' attack vector combined with required user interaction reflects the realistic delivery path - a victim must open or process a malicious CID-keyed font/document - even though the NVD description phrases the actor as a 'remote attacker.' That wording is not a true contradiction: it is the standard malicious-file pattern where delivery is remote but the CVSS vector is Local because exploitation hinges on the user handling attacker-supplied content. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' Given impact is capped at DoS (application hang/termination) and requires user interaction, this is a genuine but lower-tier priority - patch in normal cycles, prioritizing servers that automatically parse untrusted fonts (document converters, rendering services) over interactive desktops. A fix commit is referenced upstream, so remediation is available.

An attacker crafts a malicious CID-keyed font and embeds it in a document, web page, or other content, then lures a victim into opening it in an application that uses FreeType for font parsing. FreeType's CID loader repeatedly allocates and decrypts subroutine data across multiple font dictionaries, exhausting memory and CPU and causing the application or service to hang or crash. No public exploit code was identified in the provided intelligence, and exploitation requires the victim to process the crafted font (UI:R).