CVE-2015-9383

FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.

6.5 MediumFix available

FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

2.28%Up 1.3 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.

Record: CVE-2015-9383
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-125
Updated: 2026-11-02

CVE List No score

FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.

Record: CVE-2015-9383
Updated: 2026-11-02

EUVDEUVD-2015-9223 No score

FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.

Record: EUVD-2015-9223
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5qxc-8vc2-mr95 6.5

FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.

FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.

Record: GHSA-5qxc-8vc2-mr95
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSV 6.5

FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.

Record: CVE-2015-9383
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-9383 6.5

FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.

Record: DEBIAN-CVE-2015-9383
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-9383 6.5

FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.

Record: UBUNTU-CVE-2015-9383
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUSN-4126-1 No score

freetype vulnerability

It was discovered that FreeType incorrectly handled certain font files. An attacker could possibly use this issue to access sensitive information.

Record: USN-4126-1
Updated: 2026-11-02

OSVUSN-4126-2 No score

freetype vulnerabilities

USN-4126-1 fixed a vulnerability in FreeType. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

It was discovered that FreeType incorrectly handled certain font files. An attacker could possibly use this issue to access sensitive information. (CVE-2015-9381, CVE-2015-9382)

Original advisory details:

It was discovered that FreeType incorrectly handled certain font files. An attacker could possibly use this issue to access sensitive information. (CVE-2015-9383)

Record: USN-4126-2
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`freetype` Debian:12	before 2.6.3-1	2.6.3-1
`freetype` Debian:13	before 2.6.3-1	2.6.3-1
`freetype` Debian:14	before 2.6.3-1	2.6.3-1
`freetype` Debian:8	before 2.5.2-3+deb8u4, plus listed versions 2.5.2-32.5.2-3+deb8u12.5.2-3+deb8u1~kbsd8u12.5.2-3+deb8u22.5.2-3+deb8u3	2.5.2-3+deb8u4
`freetype` Ubuntu:Pro:14.04:LTS	before 2.5.2-1ubuntu2.8+esm1, plus listed versions 2.4.12-0ubuntu12.5.0.1-0ubuntu22.5.1-1ubuntu12.5.1-1ubuntu22.5.1-2ubuntu1 Show 10 moreShow less 2.5.2-1ubuntu12.5.2-1ubuntu22.5.2-1ubuntu2.12.5.2-1ubuntu2.22.5.2-1ubuntu2.32.5.2-1ubuntu2.42.5.2-1ubuntu2.52.5.2-1ubuntu2.62.5.2-1ubuntu2.72.5.2-1ubuntu2.8	2.5.2-1ubuntu2.8+esm1
`freetype` Ubuntu:16.04:LTS	before 2.6.1-0.1ubuntu2.4, plus listed versions 2.5.2-4ubuntu22.6.1-0.1ubuntu12.6.1-0.1ubuntu22.6.1-0.1ubuntu2.12.6.1-0.1ubuntu2.22.6.1-0.1ubuntu2.3	2.6.1-0.1ubuntu2.4

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-9383 is a medium vulnerability (CVSS 6.5) in Freetype, published September 3, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.28%, the 83rd percentile. Fixed in freetype 2.6.3-1.

References

Show 8 moreShow less