CVE-2026-50811

MEDIUM6.5

An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates

Published Jul 7, 2026

Modified 2 months ago

Details

References

WEB

https://gist.github.com/junius-sec/6dd0fb25b643f89914083a38e5e57ace

WEB

https://github.com/freetype/freetype/commit/5a280ecde6f324de0d226261036e736e0cb49a71

WEB

https://gitlab.freedesktop.org/freetype/freetype/-/commit/5a280ecde6f324de0d226261036e736e0cb49a71

WEB

https://gitlab.freedesktop.org/freetype/freetype/-/issues/1436

DETECTION

https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1436

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-50811

CVSS Analysis

CVSS v3.1

6.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

NoneI:N

Availability

LowA:L

6.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Ecosystems

Timeline

PublishedJul 7, 2026

ModifiedJul 8, 2026

CVE-2026-50811 | Mondoo Vulnerability Intelligence