FR
Product
FreeType
On CISA KEVExploited in the wild
95
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 6Medium 5Low 0
Watch
Add FreeType to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-15999 In wildKEV | 9.6 | Nov 3 | Google Chrome FreeType Heap Buffer Overflow Vulnerability Affected: 2.6.0 before 2.10.4 |
| CVE-2025-27363 In wildKEV | 8.1 | Mar 11 | FreeType Out-of-Bounds Write Vulnerability Affected: 0.0.0 through 2.13.0 |
| CVE-2022-27404 | 9.8 | Apr 22 | FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face Affected: before 2.12.0 |
| CVE-2015-9290 | 9.8 | Jul 30 | In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible… Affected: before 2.6.1 |
| CVE-2017-8287 | 9.8 | Apr 27 | FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c Affected: through 2.7.1 |
| CVE-2017-8105 | 9.8 | Apr 24 | FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c Affected: before 2.7.1 |
| CVE-2017-7864 | 9.8 | Apr 14 | FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c Affected: through 2.7.1 |
| CVE-2017-7858 | 9.8 | Apr 14 | FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face function in sfnt/sfobjs.c Affected: through 2.7.1 |
| CVE-2017-7857 | 9.8 | Apr 14 | FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face… Affected: 2.7 before 2.8 |
| CVE-2016-10328 | 9.8 | Apr 14 | FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c Affected: through 2.7 |
| CVE-2014-9746 | 9.8 | Jun 7 | The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in cid/cidload.c, (3) t42_parse_font_matrix function in type42/t42parse.c, and (4)… Affected: through 2.5.3 |
| CVE-2015-9381 | 8.8 | Sep 3 | FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c Affected: before 2.6.1 |
| CVE-2016-10244 | 7.8 | Mar 6 | The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of… Affected: before 2.7.1 |
| CVE-2022-27406 | 7.5 | Apr 22 | FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size Affected: before 2.12.0 |
| CVE-2022-27405 | 7.5 | Apr 22 | FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request Affected: before 2.12.0 |
| CVE-2014-9747 | 7.5 | Jun 7 | The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers… Affected: through 2.5.3 |
| CVE-2015-9383 | 6.5 | Sep 3 | FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c Affected: before 2.6.2 |
| CVE-2015-9382 | 6.5 | Sep 3 | FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation Affected: before 2.6.1 |
| CVE-2018-6942 | 6.5 | Feb 13 | An issue was discovered in FreeType 2 through 2.9 Affected: through 2.9 |
| CVE-2025-23022 | 6.2 | Jan 10 | FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c Affected: 2.8.1 |
| CVE-2026-23865 | 5.3 | Mar 2 | An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when… Affected: 2.13.2 through 2.13.3; 2.14.0 through 2.14.1 |
| CVE-2014-9745 | – | Sep 14 | The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a… Affected: through 2.5.2 |
| CVE-2014-9675 | – | Feb 8 | bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer… Affected: through 2.5.3 |
| CVE-2014-9674 | – | Feb 8 | The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote… Affected: through 2.5.3 |
| CVE-2014-9673 | – | Feb 8 | Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer… Affected: through 2.5.3 |
| CVE-2014-9672 | – | Feb 8 | Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive… Affected: through 2.5.3 |
| CVE-2014-9671 | – | Feb 8 | Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and… Affected: through 2.5.3 |
| CVE-2014-9670 | – | Feb 8 | Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer… Affected: through 2.5.3 |
| CVE-2014-9669 | – | Feb 8 | Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have… Affected: through 2.5.3 |
| CVE-2014-9668 | – | Feb 8 | The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to… Affected: through 2.5.3 |
| CVE-2014-9667 | – | Feb 8 | sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer… Affected: through 2.5.3 |
| CVE-2014-9666 | – | Feb 8 | The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote… Affected: through 2.5.3 |
| CVE-2014-9665 | – | Feb 8 | The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of… Affected: through 2.5.3 |
| CVE-2014-9664 | – | Feb 8 | FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or… Affected: through 2.5.3 |
| CVE-2014-9663 | – | Feb 8 | The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote… Affected: through 2.5.3 |
| CVE-2014-9662 | – | Feb 8 | cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based… Affected: through 2.5.3 |
| CVE-2014-9661 | – | Feb 8 | type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of… Affected: through 2.5.3 |
| CVE-2014-9660 | – | Feb 8 | The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of… Affected: through 2.5.3 |
| CVE-2014-9659 | – | Feb 8 | cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to… Affected: through 2.5.3 |
| CVE-2014-9658 | – | Feb 8 | The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service… Affected: through 2.5.3 |
| CVE-2014-9657 | – | Feb 8 | The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service… Affected: through 2.5.3 |
| CVE-2014-9656 | – | Feb 8 | The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial… Affected: through 2.5.3 |
| CVE-2014-2241 | – | Mar 18 | The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows… Affected: through 2.5.2; 2.5; 2.5.1 |
| CVE-2014-2240 | – | Mar 12 | Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly… Affected: through 2.5.2; 1.3.1; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |
| CVE-2012-5670 | – | Jan 24 | The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) via vectors related to BDF… Affected: through 2.4.10; 1.3.1; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |
| CVE-2012-5669 | – | Jan 24 | The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors… Affected: through 2.4.10; 1.3.1; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |
| CVE-2012-5668 | – | Jan 24 | FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to BDF fonts and the improper… Affected: through 2.4.10; 1.3.1; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |
| CVE-2012-1144 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and… Affected: through 2.4.8; 1.3.1; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |
| CVE-2012-1143 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (divide-by-zero error) via a… Affected: through 2.4.8; 1.3.1; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |
| CVE-2012-1142 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and… Affected: through 2.4.8; 1.3.1; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |