Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Openoffice | — | Upgrade Apache OpenOffice to the latest version | Sep 12, 2025 | May 17, 2007 |
| Apple Osx X11 | — | Apply OS X security update 2009-002 | Dec 16, 2011 | May 17, 2007 |
| Centos_linux | — | Upgrade freetype-demosUpgrade freetype-utilsUpgrade freetype-develUpgrade freetype | Dec 1, 2016 | May 17, 2007 |
| Debian | — | Upgrade freetype | Jul 30, 2024 | May 17, 2007 |
| Freebsd | — | Upgrade freetype2 | Dec 10, 2025 | May 24, 2007 |
| Gentoo Linux | — | Upgrade app-office/openoffice.Upgrade app-office/openoffice-bin.Upgrade media-libs/freetype. | Oct 30, 2017 | May 17, 2007 |
| Oracle_linux | — | Upgrade freetypeUpgrade freetype-demosUpgrade freetype-devel | Oct 16, 2024 | May 17, 2007 |
| Suse | — | Upgrade freetype2-x86Upgrade freetype2-develUpgrade freetype2-32bitUpgrade suse-releaseUpgrade freetype2Upgrade freetype2-64bitUpgrade freetype2-devel-32bitUpgrade freetype2-devel-64bit | Feb 17, 2015 | May 17, 2007 |
| Ubuntu | — | Upgrade libfreetype6 | Nov 8, 2024 | May 17, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub