Login Request a demo
Unscored severity · published Apr 17, 2009
CVE-2009-0946
Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1)…
–
CVSS
8.5%
EPSS
No
On KEV
Description
Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IO
iOS · Apple
1.0.0 through 2.2.1 · source: NVD
DL
Debian Linux · Debian
4.0; 5.0; 6.0 · source: NVD
FR
Freetype · Freetype
through 2.3.9 · source: NVD
LE
Linux Enterprise Server · Suse
10; 11 · source: NVD
MO
Mac OS X · Apple
10.6.0 through 10.6.4; 10.4.11; 10.5.8 · source: NVD
MO
Mac OS X Server · Apple
10.6.0 through 10.6.4; 10.4.11; 10.5.8 · source: NVD
OP
Opensuse · Opensuse
10.3; 11.0; 11.1 · source: NVD
SA
Safari · Apple
4.0 · source: NVD
UL
Ubuntu Linux · Canonical
6.06; 8.04; 8.10; 9.04 · source: NVD
Affected product
IO
iOS
Apple
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0946
Patch
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5
Patch
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=79972af4f0485a11dcb19551356c45245749fc5b
Patch
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a18788b14db60ae3673f932249cd02d33a227c4e
Release Notes
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog
Mailing List
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
Mailing List
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
More from iOS
10.0
CVE-2025-43300
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24085
Apple Multiple Products Use-After-Free Vulnerability
9.8
CVE-2025-31200
Apple Multiple Products Memory Corruption Vulnerability
9.8
CVE-2025-31201
Apple Multiple Products Arbitrary Read and Write Vulnerability