CVE-2016-10244
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a...
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
- Record
CVE-2016-10244- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
- Record
CVE-2016-10244- Updated
- 2026-11-02
EUVDEUVD-2016-1429 No score
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
- Record
EUVD-2016-1429- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6vgf-3977-2x4f
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a...
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
- Record
GHSA-6vgf-3977-2x4f- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2016-10244
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
- Record
ALPINE-CVE-2016-10244- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
- Record
CVE-2016-10244- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2016-10244
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
- Record
DEBIAN-CVE-2016-10244- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10244
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
- Record
UBUNTU-CVE-2016-10244- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0085 No score
Updated freetype2 packages fix security vulnerability
The parse_charstrings function in type1/t1load.c in FreeType 2 did not ensure that a font contains a glyph name, which could allow remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file (CVE-2016-10244).
- Record
MGASA-2017-0085- Updated
- 2026-11-02
OSVSUSE-SU-2018:0414-1 No score
Security update for freetype2
This update for freetype2 fixes the following security issues:
- CVE-2016-10244: Make sure that the parse_charstrings function in type1/t1load.c does ensure that a font contains a glyph name to prevent a DoS through a heap-based buffer over-read or possibly have unspecified other impact via a crafted file (bsc#1028103)
- CVE-2017-8105: Fix an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.ca (bsc#1035807)
- CVE-2017-8287: an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c (bsc#1036457)
- Fix several integer overflow issues in truetype/ttinterp.c (bsc#1079600)
- Record
SUSE-SU-2018:0414-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0462-1 No score
Security update for freetype2
This update for freetype2 fixes the following issues:
Security issue fixed:
-
CVE-2016-10244: The parse_charstrings function in type1/t1load.c did not ensure that a font contains a glyph name, which allowed remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file (bsc#1028103).
-
CVE-2017-8105: Fixed an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.ca (bsc#1035807)
-
CVE-2017-8287: an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c (bsc#1036457)
- Record
SUSE-SU-2018:0462-1- Updated
- 2026-11-02
OSVUSN-3237-1 No score
freetype vulnerability
It was discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-3237-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freetypeAlpine:v3.2 |
before 2.5.5-r1 | 2.5.5-r1 |
freetypeAlpine:v3.3 |
before 2.6.3-r0 | 2.6.3-r0 |
freetypeAlpine:v3.4 |
before 2.6.3-r1 | 2.6.3-r1 |
freetypeDebian:12 |
before 2.6.3-3.1 | 2.6.3-3.1 |
freetypeDebian:13 |
before 2.6.3-3.1 | 2.6.3-3.1 |
freetypeDebian:14 |
before 2.6.3-3.1 | 2.6.3-3.1 |
freetypeDebian:7 |
before 2.4.9-1.1+deb7u4, plus listed versions 2.4.9-1.12.4.9-1.1+deb7u12.4.9-1.1+deb7u22.4.9-1.1+deb7u3 |
2.4.9-1.1+deb7u4 |
freetypeDebian:8 |
before 2.5.2-3+deb8u2, plus listed versions 2.5.2-32.5.2-3+deb8u12.5.2-3+deb8u1~kbsd8u1 |
2.5.2-3+deb8u2 |
freetype2Mageia:5 |
before 2.5.4-2.1.mga5 | 2.5.4-2.1.mga5 |
freetype2Mageia:5 |
before 2.5.4-2.1.mga5.tainted | 2.5.4-2.1.mga5.tainted |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
freetype2SUSE:Linux Enterprise Desktop 12 SP2 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
ft2demosSUSE:Linux Enterprise Desktop 12 SP2 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
freetype2SUSE:Linux Enterprise Desktop 12 SP3 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
ft2demosSUSE:Linux Enterprise Desktop 12 SP3 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
freetype2SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
ft2demosSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
freetype2SUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
freetype2SUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
freetype2SUSE:Linux Enterprise Server 12 SP2 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
ft2demosSUSE:Linux Enterprise Server 12 SP2 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
freetype2SUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
ft2demosSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
freetype2SUSE:Linux Enterprise Server 12 SP3 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
ft2demosSUSE:Linux Enterprise Server 12 SP3 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
freetype2SUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
ft2demosSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.6.3-7.15.1 | 2.6.3-7.15.1 |
freetype2SUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 2.3.7-25.45.5.1 | 2.3.7-25.45.5.1 |
freetype2SUSE:Linux Enterprise Server 11 SP4 |
before 2.3.7-25.45.5.1 | 2.3.7-25.45.5.1 |
ft2demosSUSE:Linux Enterprise Server 11 SP4 |
before 2.3.7-25.45.5.1 | 2.3.7-25.45.5.1 |
freetype2SUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 2.3.7-25.45.5.1 | 2.3.7-25.45.5.1 |
ft2demosSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 2.3.7-25.45.5.1 | 2.3.7-25.45.5.1 |
freetypeUbuntu:14.04:LTS |
before 2.5.2-1ubuntu2.6, plus listed versions 2.4.12-0ubuntu12.5.0.1-0ubuntu22.5.1-1ubuntu12.5.1-1ubuntu22.5.1-2ubuntu1 Show 7 moreShow less2.5.2-1ubuntu12.5.2-1ubuntu22.5.2-1ubuntu2.12.5.2-1ubuntu2.22.5.2-1ubuntu2.32.5.2-1ubuntu2.42.5.2-1ubuntu2.5 |
2.5.2-1ubuntu2.6 |
freetypeUbuntu:16.04:LTS |
before 2.6.1-0.1ubuntu2.1, plus listed versions 2.5.2-4ubuntu22.6.1-0.1ubuntu12.6.1-0.1ubuntu2 |
2.6.1-0.1ubuntu2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-10244 is a high vulnerability (CVSS 7.8) in Freetype, published March 6, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.37%, the 88th percentile. Fixed in freetype 2.5.5-r1.
References
git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog?h=VER-2-7
securitytracker.com/id/1038090
security.gentoo.org/glsa/201706-14
source.android.com/security/bulletin/2017-04-01
securityfocus.com/bid/97405
bugs.chromium.org/p/oss-fuzz/issues/detail?id=36
Show 23 moreShow less
debian.org/security/2017/dsa-3839
oracle.com/security-alerts/cpuapr2020.html
nvd.nist.gov/vuln/detail/CVE-2016-10244
github.com/advisories/GHSA-6vgf-3977-2x4f
security.alpinelinux.org/vuln/CVE-2016-10244
security-tracker.debian.org/tracker/CVE-2016-10244
advisories.mageia.org/MGASA-2017-0085.html
bugs.mageia.org/show_bug.cgi?id=20465
suse.com/support/update/announcement/2018/suse-su-20180414-1
bugzilla.suse.com/1028103
ubuntu.com/security/CVE-2016-10244
cve.org/CVERecord?id=CVE-2016-10244