Integer Overflow Vulnerability in FreeType 2.8.1 from FreeType
CVE-2025-23022

4MEDIUM

Key Information:

Vendor
Freetype
Status
Freetype
Vendor
CVE Published:
10 January 2025

Summary

FreeType 2.8.1 contains an integer overflow vulnerability in the function cf2_doFlex located in cff/cf2intrp.c, which can lead to unexpected behavior or exploitation opportunities. This flaw could potentially allow attackers to manipulate memory allocation and execute arbitrary code, posing a substantial risk to software that relies on this library. It is crucial for users and developers to apply necessary patches to mitigate these security risks.

Affected Version(s)

FreeType 2.8.1

References

https://gitlab.freedesktop.org/freetype/freetype/-/issues...

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.