p PatchFirst

CVE-2026-50811

CVE-2026-50811

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates

CVSS 6.5 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • freetype Debian:14

    Versions
    • 2.13.3+dfsg-1
    • 2.14.1+dfsg-1
    • 2.14.1+dfsg-2
    • 2.14.2+dfsg-1
    • 2.14.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 2.14.3+dfsg-2

    Update to 2.14.3+dfsg-2

  • freetype Ubuntu:25.10

    Versions
    • 2.13.3+dfsg-1
    • 2.13.3+dfsg-1build1
    • 2.13.3+dfsg-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freetype Ubuntu:26.04:LTS

    Versions
    • 2.13.3+dfsg-1build1
    • 2.14.1+dfsg-1
    • 2.14.1+dfsg-2
    • 2.14.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 2.14.2+dfsg-1ubuntu0.1

    Update to 2.14.2+dfsg-1ubuntu0.1

Original sources

Check your server →