Junglewise Threat Intelligence

CVE-2026-50811: FreeType out-of-bounds read in TrueType GX variation API

CVE-2026-50811 · Severity: info · CVSS 7.1 · Published 2026-07-07

Technologies: FreeType. Vendors: Freetype.

Executive brief

FreeType, a widely used library for rendering fonts, contains a vulnerability that can expose sensitive system information. By providing a specially crafted font file, an attacker can trick the software into revealing internal memory addresses, such as those for the system's heap or core libraries (libc). This information can be used to bypass security protections like ASLR, making it easier to launch more complex attacks against the system.

Technical details

An out-of-bounds read vulnerability exists in FreeType's TrueType GX implementation within `src/truetype/ttgxvar.c`. The root cause is in the `TT_Get_Var_Design` function, which is used by the public `FT_Get_Var_Design_Coordinates` API. When a caller requests more design coordinates than the font actually possesses, the function fails to properly bound its loop, continuing to read from the `FT_Var_Axis` array into adjacent heap memory. An attacker can exploit this by providing a crafted variable font and requesting excess coordinates, leading to the disclosure of `FT_Face` pointers and `libc` addresses. This primitive can be used to bypass ASLR in processes that parse untrusted font files. The issue was fixed by ensuring excess coordinates are zero-filled instead of read from memory.

Affected products

  • FreeType FreeType 2.14.3 and earlier versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71

Timeline

  • 2026-05-12: other: Vulnerability identified in FreeType origin/master
  • 2026-05-13: patched: Fix committed to FreeType source (commit 5a280ec)
  • 2026-07-07: disclosed: CVE-2026-50811 published

References