CVE-2022-31782

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

7.8 HighFix available

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.77%Down 0.1 points since May 28, 2022

What each source reports

NVD Score used 7.8

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

Record: CVE-2022-31782
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

Record: CVE-2022-31782
Updated: 2026-11-02

EUVDEUVD-2022-53174 No score

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

Record: EUVD-2022-53174
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2rjg-8x42-r2x7 7.8

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

Record: GHSA-2rjg-8x42-r2x7
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVOESA-2025-1956 7.8

freetype security update

Security Fix(es):

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.(CVE-2022-31782)

Record: OESA-2025-1956
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1957 7.8

freetype security update

Security Fix(es):

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.(CVE-2022-31782)

Record: OESA-2025-1957
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVUBUNTU-CVE-2022-31782 7.8

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

Record: UBUNTU-CVE-2022-31782
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV No score

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

Record: CVE-2022-31782
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-31782 No score

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.

Record: DEBIAN-CVE-2022-31782
Updated: 2026-11-03

OSVMGASA-2022-0297 No score

Updated freetype2 packages fix security vulnerability

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow. (CVE-2022-31782)

Record: MGASA-2022-0297
Updated: 2026-11-02

OSVUSN-5528-1 No score

freetype vulnerabilities

It was discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash, or possibly execute arbitrary code.

Record: USN-5528-1
Updated: 2026-11-02

Affected products

freedesktop freetype demo programs

Affected packages

Affected packages
Package	Affected	Fixed
`freetype` Debian:12	before 2.12.1+dfsg-3	2.12.1+dfsg-3
`freetype` Debian:13	before 2.12.1+dfsg-3	2.12.1+dfsg-3
`freetype` Debian:14	before 2.12.1+dfsg-3	2.12.1+dfsg-3
`freetype2` Mageia:8	before 2.10.4-2.2.mga8	2.10.4-2.2.mga8
`freetype2` Mageia:8	before 2.10.4-2.2.mga8.tainted	2.10.4-2.2.mga8.tainted
`freetype` openEuler:22.03-LTS-SP3	before 2.12.1-6.oe2203sp3	2.12.1-6.oe2203sp3
`freetype` openEuler:22.03-LTS-SP4	before 2.12.1-6.oe2203sp4	2.12.1-6.oe2203sp4
`freetype` Ubuntu:18.04:LTS	before 2.8.1-2ubuntu2.2, plus listed versions 2.8-0.2ubuntu22.8.1-0.1ubuntu22.8.1-0.1ubuntu32.8.1-2ubuntu12.8.1-2ubuntu22.8.1-2ubuntu2.1	2.8.1-2ubuntu2.2
`freetype` Ubuntu:20.04:LTS	before 2.10.1-2ubuntu0.2, plus listed versions 2.9.1-42.10.1-22.10.1-2ubuntu0.1	2.10.1-2ubuntu0.2
`freetype` Ubuntu:22.04:LTS	before 2.11.1+dfsg-1ubuntu0.1, plus listed versions 2.10.4+dfsg-1build12.10.4+dfsg-1build22.11.0+dfsg-12.11.1+dfsg-12.11.1+dfsg-1build1	2.11.1+dfsg-1ubuntu0.1
`freetype` Ubuntu:18.04:LTS From an advisory covering 4 CVEs	before 2.8.1-2ubuntu2.2, plus listed versions 2.8-0.2ubuntu22.8.1-0.1ubuntu22.8.1-0.1ubuntu32.8.1-2ubuntu12.8.1-2ubuntu22.8.1-2ubuntu2.1	2.8.1-2ubuntu2.2
`freetype` Ubuntu:20.04:LTS From an advisory covering 4 CVEs	before 2.10.1-2ubuntu0.2, plus listed versions 2.9.1-42.10.1-22.10.1-2ubuntu0.1	2.10.1-2ubuntu0.2
`freetype` Ubuntu:22.04:LTS From an advisory covering 4 CVEs	before 2.11.1+dfsg-1ubuntu0.1, plus listed versions 2.10.4+dfsg-1build12.10.4+dfsg-1build22.11.0+dfsg-12.11.1+dfsg-12.11.1+dfsg-1build1	2.11.1+dfsg-1ubuntu0.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31782 is a high vulnerability (CVSS 7.8) in Freedesktop Freetype Demo Programs, published May 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in freetype 2.12.1+dfsg-3.

References

Show 9 moreShow less