Integer Overflow Vulnerability in FreeType 2.8.1 from FreeType
CVE-2025-23022

4MEDIUM

Key Information:

Vendor

Freetype

Status
Freetype
Vendor
CVE Published:
10 January 2025

What is CVE-2025-23022?

FreeType 2.8.1 contains an integer overflow vulnerability in the function cf2_doFlex located in cff/cf2intrp.c, which can lead to unexpected behavior or exploitation opportunities. This flaw could potentially allow attackers to manipulate memory allocation and execute arbitrary code, posing a substantial risk to software that relies on this library. It is crucial for users and developers to apply necessary patches to mitigate these security risks.

Affected Version(s)

FreeType 2.8.1

References

https://gitlab.freedesktop.org/freetype/freetype/-/issues...
https://security-tracker.debian.org/tracker/CVE-2025-23022

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.