CVE-2016-10244

What it actually does

Heap-based buffer over-read in parse_charstrings during Type1 font processing when a glyph name is absent, enabling denial of service or unspecified memory corruption effects.

Why it matters to the business

Applications rendering documents or fonts may crash when encountering crafted files, interrupting workflows in desktop and server environments; the issue is more than nine years old with public exploits available but no observed ransomware or KEV-listed campaigns.

How an attack unfolds

An attacker supplies a crafted Type1 font lacking a required glyph name; when a victim opens the file in an application linked to vulnerable FreeType, the parse_charstrings function performs an out-of-bounds read on the heap.

How to fix it

Upgrade FreeType to the version containing commit 069083cccd73d1d68da68116c8d050bb62cdfe0e or later; rebuild and redeploy any applications that statically link or bundle the library.

How to confirm the fix worked

Confirm the installed FreeType version is 2.7 or newer, or inspect the source tree for the presence of the referenced commit hash in t1load.c.

Typical attack path

1. Create a malicious Type1 font missing a glyph name entry
2. Deliver the font inside a document, email attachment, or web resource
3. Victim opens the file with an affected application
4. FreeType parsing triggers the buffer over-read

How to detect it

Review application crash logs and core dumps from processes that load fonts; correlate unexpected terminations with recent file opens involving Type1 or PostScript fonts.

What your security team should do

• Update FreeType across all desktop, server, and embedded deployments
• Audit and replace any vendored or statically linked copies of the library
• Test font-handling paths in document viewers and printers after patching