# CVE-2026-50811: FreeType out-of-bounds read in TrueType GX variation API

Source: https://junglewise.ai/threats/cve-2026-50811-freetype-out-of-bounds-read-in-truetype-gx-variation-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-50811 · Severity: info · CVSS 7.1 · Published 2026-07-07

FreeType, a widely used library for rendering fonts, contains a vulnerability that can expose sensitive system information. By providing a specially crafted font file, an attacker can trick the software into revealing internal memory addresses, such as those for the system's heap or core libraries (libc). This information can be used to bypass security protections like ASLR, making it easier to launch more complex attacks against the system.

## Quick answers

**Is CVE-2026-50811 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50811 being exploited in the wild.

**How severe is CVE-2026-50811?** Informational severity, with a CVSS score of 7.1, published 7 July 2026.

**Which products and versions are affected?** FreeType FreeType 2.14.3 and earlier versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71.

**Is there a fix for CVE-2026-50811?** A patch was published on 2026-05-13: Fix committed to FreeType source (commit 5a280ec) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50811 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-50811?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in FreeType's TrueType GX implementation within `src/truetype/ttgxvar.c`. The root cause is in the `TT_Get_Var_Design` function, which is used by the public `FT_Get_Var_Design_Coordinates` API. When a caller requests more design coordinates than the font actually possesses, the function fails to properly bound its loop, continuing to read from the `FT_Var_Axis` array into adjacent heap memory. An attacker can exploit this by providing a crafted variable font and requesting excess coordinates, leading to the disclosure of `FT_Face` pointers and `libc` addresses. This primitive can be used to bypass ASLR in processes that parse untrusted font files. The issue was fixed by ensuring excess coordinates are zero-filled instead of read from memory.

## Affected products

- FreeType FreeType 2.14.3 and earlier versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71

## Timeline

- 2026-05-12: other: Vulnerability identified in FreeType origin/master
- 2026-05-13: patched: Fix committed to FreeType source (commit 5a280ec)
- 2026-07-07: disclosed: CVE-2026-50811 published

## References

- [https://gist.github.com/junius-sec/6dd0fb25b643f89914083a38e5e57ace](https://gist.github.com/junius-sec/6dd0fb25b643f89914083a38e5e57ace)
- [https://github.com/freetype/freetype/commit/5a280ecde6f324de0d226261036e736e0cb49a71](https://github.com/freetype/freetype/commit/5a280ecde6f324de0d226261036e736e0cb49a71)
- [https://gitlab.freedesktop.org/freetype/freetype/-/commit/5a280ecde6f324de0d226261036e736e0cb49a71](https://gitlab.freedesktop.org/freetype/freetype/-/commit/5a280ecde6f324de0d226261036e736e0cb49a71)
- [https://gitlab.freedesktop.org/freetype/freetype/-/issues/1436](https://gitlab.freedesktop.org/freetype/freetype/-/issues/1436)