CVE-2022-40009

What it actually does

Heap use-after-free in grow_unicode allows memory corruption that can lead to arbitrary code execution when processing crafted TrueType font data.

Why it matters to the business

Attackers can remotely compromise systems rendering web or document content containing malicious fonts, leading to full system takeover; the vulnerability affects widely deployed web rendering libraries on Debian and Ubuntu servers and desktops with public exploits available for nearly four years.

How an attack unfolds

An attacker crafts a malicious font file that triggers the use-after-free during unicode string growth in ttf processing, then serves it via a web page or document; when the victim application parses the font, the freed memory is reused for attacker-controlled data resulting in code execution. Public exploits exist and EPSS has risen 14% in the last 30 days.

How to fix it

Upgrade webkit2gtk and wpewebkit packages to the fixed versions: 2.28.4-1 on Debian 11/12/13 and 2.28.4-0ubuntu0.18.04.1 on Ubuntu 18.04 LTS. Apply vendor updates immediately and restart affected services.

How to confirm the fix worked

Verify installed package versions match or exceed the listed fixed releases, run regression tests with font parsing workloads, and confirm no crash or memory error occurs when processing the original proof-of-concept font.

Typical attack path

1. Attacker prepares a specially crafted TrueType font triggering grow_unicode use-after-free
2. Malicious font is delivered through a web page, document, or media file
3. Target application parses the font using the vulnerable webkit2gtk/wpewebkit library
4. Freed heap memory is overwritten with attacker data leading to control-flow hijacking
5. Arbitrary code executes with the privileges of the rendering process

How to detect it

Search application and system logs for crashes or segmentation faults during font loading in webkit processes; examine core dumps or memory sanitizer reports referencing grow_unicode or ttf.c for evidence of prior exploitation attempts.

What your security team should do

• Prioritize patching all Debian and Ubuntu systems running webkit2gtk or wpewebkit within the next 48 hours due to public exploit availability
• Inventory all applications depending on these libraries and schedule restarts after upgrade
• Enable memory safety mitigations such as ASLR and sandboxing where available until patches are applied
• Monitor EPSS trend and exploit maturity updates for any change in urgency