{"id":"CVE-2026-50811","aliases":["DEBIAN-CVE-2026-50811","EUVD-2026-42157","GHSA-v5fr-wv7c-jq2m","MGASA-2026-0472","RHSA-2026:36841","SUSE-SU-2026:22750-1","SUSE-SU-2026:22815-1","SUSE-SU-2026:22922-1","SUSE-SU-2026:23074-1","UBUNTU-CVE-2026-50811","USN-8562-1","openSUSE-SU-2026:11257-1","openSUSE-SU-2026:21362-1"],"status":"published","title":"An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit...","description":"An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00474,"percentile":0.41408,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-07-07T00:00:00Z","modified":"2026-10-28T11:16:46Z","fixes":[{"ecosystem":"Debian:14","package":"freetype","fixed_in":["2.14.3+dfsg-2"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"freetype2","fixed_in":["2.14.2-1.1.mga10.tainted"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"freetype","fixed_in":["0:2.14.3-1.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"freetype-demos","fixed_in":["0:2.14.3-1.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"freetype-devel","fixed_in":["0:2.14.3-1.2.hum1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"freetype2","fixed_in":["2.14.3-1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"freetype2","fixed_in":["2.14.3-slfo.1.1_1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"freetype","fixed_in":["2.14.2+dfsg-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"freetype2","fixed_in":["2.14.3-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3+dfsg-2"}]}],"versions":["2.13.3+dfsg-1","2.14.1+dfsg-1","2.14.1+dfsg-2","2.14.2+dfsg-1","2.14.3+dfsg-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.2-1.1.mga10.tainted"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.14.3-1.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"freetype-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.14.3-1.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.14.3-1.2.hum1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3-1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3-slfo.1.1_1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.13.3+dfsg-1","2.13.3+dfsg-1build1","2.13.3+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.2+dfsg-1ubuntu0.1"}]}],"versions":["2.13.3+dfsg-1build1","2.14.1+dfsg-1","2.14.1+dfsg-2","2.14.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.2+dfsg-1ubuntu0.1"}]}],"versions":["2.13.3+dfsg-1build1","2.14.1+dfsg-1","2.14.1+dfsg-2","2.14.2+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3-160000.1.1"}]}],"bundled":2}],"references":[{"url":"https://gitlab.freedesktop.org/freetype/freetype/-/issues/1436","tags":["report","article"]},{"url":"https://gitlab.freedesktop.org/freetype/freetype/-/commit/5a280ecde6f324de0d226261036e736e0cb49a71","tags":["fix","article"]},{"url":"https://github.com/freetype/freetype/commit/5a280ecde6f324de0d226261036e736e0cb49a71","tags":["fix","article"]},{"url":"https://gist.github.com/junius-sec/6dd0fb25b643f89914083a38e5e57ace","tags":["web","article"]},{"url":"https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1436","tags":["exploit","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50811","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v5fr-wv7c-jq2m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50811.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-50811","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0472.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35931","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ZFL5DU5VYR7IO6AIBJXA3PU262H5MJCS/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8562-1","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36841","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50811","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36841.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497912","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50811","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622750-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1252148","tags":["report"]},{"url":"https://bugzilla.suse.com/1259118","tags":["report"]},{"url":"https://bugzilla.suse.com/1271045","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50811","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622815-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622922-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623074-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-50811","tags":["report"]},{"url":"https://gitlab.freedesktop.org/freetype/freetype/-/merge_requests/432","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-50811","description":"An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-07-08T19:47:19.631Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-42157","description":"An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-07-08T19:47:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:10.095263Z"}],"ghsa":[{"id":"GHSA-v5fr-wv7c-jq2m","title":"An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit...","description":"An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates","status":"published","published":"2026-07-08T00:37:56Z","modified":"2026-07-08T21:31:26Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:09:20.981798Z"}],"nvd":[{"id":"CVE-2026-50811","description":"An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates","status":"published","published":"2026-07-07T23:16:55.017Z","modified":"2026-07-09T17:02:37.96Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"CVE-2026-50811","description":"An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-10-28T11:16:46.195593923Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"DEBIAN-CVE-2026-50811","description":"An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates","status":"published","published":"2026-07-07T23:16:55.017Z","modified":"2026-10-01T03:03:24.752323188Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:56.877408Z"},{"id":"RHSA-2026:36841","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-22T10:23:04Z","modified":"2026-10-17T10:12:55Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"UBUNTU-CVE-2026-50811","description":"An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates","status":"published","published":"2026-07-07T23:16:00Z","modified":"2026-07-21T13:09:21.78703392Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"MGASA-2026-0472","title":"Updated freetype2 package fixes a security vulnerability","description":"An out-of-bounds read vulnerability exists in FreeType 2.14.3 and\nversions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in\nsrc/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by\nFT_Get_Var_Design_Coordinates. (CVE-2026-50811)\n","status":"published","published":"2026-10-09T17:00:24Z","modified":"2026-10-09T17:15:03.503889578Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11257-1","title":"freetype2-devel-2.14.3-1.1 on GA media","description":"These are all security issues fixed in the freetype2-devel-2.14.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-12T00:00:00Z","modified":"2026-07-13T09:00:09.874260394Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21362-1","title":"Security update for freetype2","description":"This update for freetype2 fixes the following issues\n\n- Update to version 2.14.3\n- CVE-2026-23865: Integer overflow in the tt_var_load_item_variation_store function (bsc#1259118).\n- CVE-2026-50811: out-of-bounds read vulnerabilityin src/truetype/ttgxvar.c in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates (bsc#1271045).\n","status":"published","published":"2026-07-16T18:48:33Z","modified":"2026-07-18T08:45:07.379413546Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22750-1","title":"Security update for freetype2","description":"This update for freetype2 fixes the following issues\n\n- Update to version 2.14.3\n- CVE-2026-23865: Integer overflow in the tt_var_load_item_variation_store function (bsc#1259118).\n- CVE-2026-50811: out-of-bounds read vulnerabilityin src/truetype/ttgxvar.c in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates (bsc#1271045).\n","status":"published","published":"2026-07-16T18:45:28Z","modified":"2026-07-23T18:24:18.875474371Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22815-1","title":"Security update for freetype2","description":"This update for freetype2 fixes the following issues\n\n- Update to version 2.14.3\n- CVE-2026-23865: Integer overflow in the tt_var_load_item_variation_store function (bsc#1259118).\n- CVE-2026-50811: out-of-bounds read vulnerabilityin src/truetype/ttgxvar.c in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates (bsc#1271045).\n","status":"published","published":"2026-07-16T18:45:28Z","modified":"2026-07-28T18:24:06.850014188Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22922-1","title":"Security update for freetype2","description":"This update for freetype2 fixes the following issue\n\n- Update to version 2.14.3\n- CVE-2026-50811: out-of-bounds read vulnerabilityin src/truetype/ttgxvar.c in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates (bsc#1271045).\n","status":"published","published":"2026-07-24T08:13:27Z","modified":"2026-07-28T18:24:15.097667404Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23074-1","title":"Security update for freetype2","description":"This update for freetype2 fixes the following issue\n\nUpdate freetype2 and ft2demos to version 2.14.3.\n\n- CVE-2026-50811: out-of-bounds read in `src/truetype/ttgxvar.c` in the `TT_Get_Var_Design` implementation used\n  by `FT_Get_Var_Design_Coordinates` (bsc#1271045).\n","status":"published","published":"2026-07-31T09:32:50Z","modified":"2026-08-14T18:23:35.733475158Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"USN-8562-1","title":"freetype vulnerability","description":"It was discovered that FreeType incorrectly handled certain variable font\nfiles. An attacker could possibly use this issue to cause FreeType to\ncrash, resulting in a denial of service, or obtain sensitive information.","status":"published","published":"2026-07-20T11:59:08Z","modified":"2026-07-21T13:20:14.541189994Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}