CVE-2010-3814
Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier...
Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font.
- Record
CVE-2010-3814- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font.
- Record
CVE-2010-3814- Updated
- 2026-11-02
EUVDEUVD-2010-3793 No score
Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font.
- Record
EUVD-2010-3793- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fxh2-ppwm-fpwr No score
Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier...
Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font.
- Record
GHSA-fxh2-ppwm-fpwr- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font.
- Record
CVE-2010-3814- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-3814 No score
Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font.
- Record
DEBIAN-CVE-2010-3814- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10172-1 No score
ft2demos-2.7-1.1 on GA media
These are all security issues fixed in the ft2demos-2.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10172-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10438-1 No score
freetype2-devel-2.7-1.1 on GA media
These are all security issues fixed in the freetype2-devel-2.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10438-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freetypeDebian:12 |
before 2.4.2-2.1 | 2.4.2-2.1 |
freetypeDebian:13 |
before 2.4.2-2.1 | 2.4.2-2.1 |
freetypeDebian:14 |
before 2.4.2-2.1 | 2.4.2-2.1 |
freetypeDebian:5.0 From an advisory covering 2 CVEs |
before 2.3.7-2+lenny5, plus listed versions 2.3.7-22.3.7-2+lenny12.3.7-2+lenny22.3.7-2+lenny32.3.7-2+lenny4 |
2.3.7-2+lenny5 |
ft2demosopenSUSE:Tumbleweed From an advisory covering 32 CVEs |
before 2.7-1.1 | 2.7-1.1 |
freetype2openSUSE:Tumbleweed From an advisory covering 55 CVEs |
before 2.7-1.1 | 2.7-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3814 is a medium vulnerability (CVSS 6.8) in Freetype, published November 26, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.89%, the 90th percentile. Fixed in freetype 2.4.2-2.1.
References
secunia.com/advisories/43138
bugs.debian.org/cgi-bin/bugreport.cgi?bug=602221
vupen.com/english/advisories/2011/0246
securitytracker.com/id?1024767
lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
Show 68 moreShow less
ubuntu.com/usn/USN-1013-1
git.savannah.gnu.org/cgit/freetype/freetype2.git/commit?id=0edf0986f3be570f5bf90ff245a85c1675f5c9a4
mandriva.com/security/advisories?name=MDVSA-2010:236
security-tracker.debian.org/tracker/CVE-2010-3814
securityfocus.com/bid/44643
support.apple.com/kb/HT4456
debian.org/security/2011/dsa-2155
nvd.nist.gov/vuln/detail/CVE-2010-3814
github.com/advisories/GHSA-fxh2-ppwm-fpwr
suse.com/security/cve/CVE-2009-0946