CVE-2016-10328

What it actually does

Heap-based buffer overflow in cff_parser_run allows an out-of-bounds write during CFF font parsing, enabling memory corruption that can lead to arbitrary code execution or process crash.

Why it matters to the business

Applications or systems relying on unpatched FreeType for font rendering face risk of remote compromise when processing attacker-supplied fonts, potentially affecting document viewers, browsers, and embedded UI components; the vulnerability is old with stable low exploitation probability but remains relevant in un-upgraded image builds.

How an attack unfolds

An attacker supplies a specially crafted CFF font that triggers the overflow inside cff_parser_run; when the victim application parses the font the write corrupts adjacent heap structures, allowing control-flow hijacking or denial of service.

How to fix it

Upgrade FreeType to a fixed build: istio-pilot-agent-1.19 (Chainguard or Wolfi) to 1.19.6-r1 or later; rebuild any containers using the git commit beecf80a6deecbaf5d264d4f864451bde4fe98b8 or newer; rebuild and redeploy affected images with updated packages.

How to confirm the fix worked

Confirm installed FreeType version or container image digest matches a fixed release; re-scan rebuilt images for the CVE and verify absence of the vulnerable cffparse.c code path.

Typical attack path

1. Craft malicious CFF font file that overflows the parser buffer
2. Deliver font via web page, document, or container image layer
3. Target application loads and parses the font with vulnerable FreeType
4. Overflow writes attacker-controlled data to heap memory
5. Achieve code execution or crash the process

How to detect it

Review application or container logs for unexpected crashes or segmentation faults during font loading; inspect process memory dumps or core files for heap corruption patterns around CFF parsing; correlate with delivery of unusual font-containing files.

What your security team should do

• Immediately rebuild and redeploy any images containing the listed affected packages to the stated fixed versions
• Add FreeType version checks to container image scanning policies
• Prioritize updates for internet-facing or document-processing workloads
• Monitor EPSS trend and re-evaluate if exploitation maturity increases