Executive brief
FreeType is a widely used font rendering library that processes TrueType and OpenType fonts across many platforms and applications. An integer overflow vulnerability in the color layer blending function allows remote code execution through a specially crafted font file, potentially giving attackers control over systems that parse untrusted fonts.
Technical details
An integer overflow in the tt_face_colr_blend_layer function of ttcolr.c (part of FreeType's COLR table handling) can be triggered by a maliciously crafted font file. The vulnerability does not require authentication or user interaction beyond opening/processing a malicious font, and operates at a local level. Successful exploitation allows an attacker to achieve local privilege escalation or, depending on context, remote code execution. The Android security bulletin indicates patches are available in AOSP; FreeType upstream should also have addressed this issue.
Affected products
- FreeType FreeType <UNKNOWN>
Timeline
- 2026-09-08: disclosed
- 2026-09-01: advisory: Android Security Bulletin published