CVE-2026-23865

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.

References

Affected packages

Git / gitlab.com/freetype/freetype

Affected ranges

Type

GIT

Repo

https://gitlab.com/freetype/freetype

Events

Introduced

920c5502cc3ddda88f6c7d85ee834ac611bb11cc

Last Affected

42608f77f20749dd6ddc9e0536788eaad70ea4b5

Introduced

007c46ebbf45fc9debeebc01c7739f725faee342

Last Affected

526ec5c47b9ebccc4754c85ac0c0cdf7c85a5e9b

Fixed

fc85a255849229c024c8e65f536fe1875d84841c

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.13.2"
                },
                {
                    "last_affected":  "2.13.3"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.14.0"
                },
                {
                    "last_affected":  "2.14.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "fc85a255849229c024c8e65f536fe1875d84841c"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other

VER-2-13-2

VER-2-13-3

VER-2-14-0

VER-2-14-1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23865.json"