CVE-2026-50811

What it actually does

This vulnerability is an out-of-bounds read in FreeType's TrueType GX/variable-font handling code, specifically in src/truetype/ttgxvar.c within TT_Get_Var_Design, which is used by FT_Get_Var_Design_Coordinates. When FreeType processes a specially crafted font or variable-font structure, it may read memory outside the intended bounds. The likely effects are limited information disclosure through unintended memory reads and application instability or crashes. The CVSS vector indicates the issue can be triggered remotely in software that accepts or processes attacker-supplied fonts without authentication, with low attack complexity and potential confidentiality and availability impact.

Why it matters to the business

Organizations using FreeType in document viewers, browsers, image processing pipelines, font preview services, PDF/rendering services, desktop environments, or server-side content processing may face service crashes or limited memory disclosure if untrusted fonts are processed. Because FreeType is widely embedded in operating systems, applications, and third-party libraries, exposure may exist indirectly through packaged dependencies even when FreeType is not used directly. The current EPSS score is low and there is no known KEV listing or known ransomware association, so broad active exploitation is not currently indicated, but remediation should still be prioritized for internet-facing or automated file-processing systems.

How an attack unfolds

An attacker prepares a malicious TrueType or variable font file that triggers the faulty bounds handling in FreeType's variable-font coordinate retrieval path. The attacker then delivers the font to software that uses a vulnerable FreeType version, such as by uploading it to a rendering service, embedding it in a document, serving it through web content, or placing it where an automated indexing, preview, or conversion pipeline will process it. When the vulnerable application calls FT_Get_Var_Design_Coordinates, FreeType reaches TT_Get_Var_Design and reads outside the valid memory region. Depending on the consuming application and build protections, this may cause a crash, denial of service, or limited leakage of adjacent process memory. There is currently no public indication of mature exploitation or known threat actor use.

How to fix it

Upgrade FreeType to a version that includes commit 5a280ecde6f324de0d226261036e736e0cb49a71 or any later vendor-supported release containing the fix. Where FreeType is bundled inside applications, operating system packages, container images, SDKs, browsers, PDF tools, graphics stacks, or language bindings, update those packages as well rather than only updating a system library. If immediate patching is not possible, reduce risk by blocking or quarantining untrusted font uploads, disabling server-side font rendering where feasible, processing untrusted documents in a sandbox, applying memory-safety hardening such as ASLR and compiler sanitizers where practical, and isolating rendering/conversion workers from sensitive data and internal networks.

How to confirm the fix worked

Confirm installed and bundled FreeType versions are newer than 2.14.3 or include commit 5a280ecde6f324de0d226261036e736e0cb49a71. Validate both system packages and statically linked or vendored copies inside applications, containers, and appliances. On Linux systems, review package manager metadata and application dependency manifests; for source builds, inspect the FreeType source tree or build provenance for the fixed commit. Exercise representative font-processing workflows after patching to confirm normal rendering still works and that malformed test fonts no longer crash the application. For high-risk services, run the font-processing component under AddressSanitizer or similar tooling in a test environment to verify that TT_Get_Var_Design and FT_Get_Var_Design_Coordinates no longer produce out-of-bounds read findings.

Typical attack path

1. Identify an application, service, or processing pipeline that uses a vulnerable FreeType version.
2. Create or obtain a malformed TrueType GX or variable font designed to exercise the vulnerable coordinate-handling code path.
3. Deliver the font through an accepted input channel such as file upload, document import, archive processing, web content, email attachment, or font preview.
4. Trigger rendering, parsing, indexing, conversion, or metadata extraction by the target application.
5. Cause FreeType to execute FT_Get_Var_Design_Coordinates and reach the vulnerable TT_Get_Var_Design implementation.
6. Observe a crash, service disruption, or potential exposure of limited process memory depending on application behavior and error handling.

How to detect it

To determine whether this issue may have already been exploited, review telemetry from applications that parse or render fonts, documents, PDFs, images, web content, or uploaded files. Focus on crashes or abnormal terminations that occurred after processing user-supplied fonts or documents. Relevant log sources include application logs, web upload logs, document-conversion service logs, container logs, systemd journals, kernel crash logs, endpoint detection telemetry, core dump metadata, and sanitizer/fuzzing logs. Look for segmentation faults, bus errors, aborts, or AddressSanitizer reports referencing FreeType, ttgxvar.c, TT_Get_Var_Design, or FT_Get_Var_Design_Coordinates. Correlate crashes with recently uploaded or fetched font files, documents containing embedded fonts, archives with font files, or repeated requests from the same source. Preserve suspect input files, core dumps, and process memory artifacts for analysis. Since this is an out-of-bounds read rather than a straightforward command-execution flaw, there may be no obvious post-exploitation artifact beyond crashes, malformed font inputs, and memory-safety diagnostics.

• TT_Get_Var_Design
• FT_Get_Var_Design_Coordinates
• src/truetype/ttgxvar.c
• ttgxvar.c
• AddressSanitizer: heap-buffer-overflow
• AddressSanitizer: global-buffer-overflow
• AddressSanitizer: stack-buffer-overflow
• AddressSanitizer: SEGV
• runtime error: load of address
• freelib: TT_Get_Var_Design
• freetype: TT_Get_Var_Design
• libfreetype.so
• libfreetype.dylib
• freetype.dll
• Segmentation fault
• SIGSEGV
• Bus error
• SIGBUS

What your security team should do

• Inventory systems, applications, containers, and appliances that include FreeType, especially file upload, document conversion, PDF rendering, image processing, browser-like rendering, and font preview components.
• Prioritize patching internet-facing and automated processing services that accept untrusted documents, fonts, archives, or web content.
• Upgrade to a FreeType build containing commit 5a280ecde6f324de0d226261036e736e0cb49a71 or a later vendor release that incorporates the fix.
• Check for statically linked or vendored FreeType copies in third-party applications and container images, not only the operating system package.
• Sandbox document and font processing workers and restrict their access to secrets, sensitive files, and internal network resources.
• Monitor crash telemetry and application logs for FreeType-related faults, especially in TT_Get_Var_Design, FT_Get_Var_Design_Coordinates, and ttgxvar.c.
• Because there is no KEV listing, no ransomware association, low EPSS, and no known exploit maturity at this time, treat this as important hygiene unless the affected component processes untrusted content at scale, in which case prioritize more urgently.