CVE-2025-23022

FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

4.0 MediumFix available

FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.24%Up 0.2 points since Jan 11, 2025

What each source reports

CVE List Score used 4.0

FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

Record: CVE-2025-23022
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-190
Updated: 2026-11-02

EUVDEUVD-2025-3078 4.0

FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

Record: EUVD-2025-3078
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7429-74cp-cgh9 4.0

FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

Record: GHSA-7429-74cp-cgh9
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-190
Updated: 2026-11-02

NVD 4.0

FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

Record: CVE-2025-23022
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSV 4.0

FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

Record: CVE-2025-23022
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-190
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-23022 4.0

FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

Record: UBUNTU-CVE-2025-23022
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVSUSE-SU-2025:1528-1 No score

Security update for freetype2

This update for freetype2 fixes the following issues:

CVE-2025-23022: signed integer overflow in cf2_doFlex in cff/cf2intrp.c. (bsc#1235670)

Record: SUSE-SU-2025:1528-1
Updated: 2026-11-02

Affected products

freetype

Affected packages

Affected packages
Package	Affected	Fixed
`freetype2` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	before 2.6.3-7.24.1	2.6.3-7.24.1
`ft2demos` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	before 2.6.3-7.24.1	2.6.3-7.24.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-23022 is a medium vulnerability (CVSS 4.0) in Freetype, published January 10, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in freetype2 2.6.3-7.24.1.

References

Show 4 moreShow less