CVE-2006-0747: freetype Numeric Errors

EPSS trend

Probability

12.72%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 12.72% on 20-09-2026

20-09-202620-10-2026

EPSS score

12.72%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databaseremoteunixVerified
FreeType - '.TTF' File Remote Buffer Overflow
Maturity: weaponized

References

29 links

lists.suse.com/archive/suse-security-announce/2006-Jun/0012.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/20791Third Party AdvisoryX Refsource SECUNIAVendor Advisory
support.apple.com/kb/HT3549X Refsource CONFIRM
sunsolve.sun.com/search/document.do?assetkey=1-26-102705-1Vendor AdvisoryX Refsource SUNALERT
secunia.com/advisories/20525Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/21701Third Party AdvisoryX Refsource SECUNIAVendor Advisory
usn.ubuntu.com/291-1/Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/21385Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/35074Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lists.apple.com/archives/security-announce/2009/May/msg00002.htmlVendor AdvisoryX Refsource APPLE

Show all 29 references

www.securityfocus.com/archive/1/436836/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/21135Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2006-0500.htmlVendor AdvisoryX Refsource REDHAT
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9508VDB EntrySignatureX Refsource OVAL
www.securityfocus.com/bid/18326VDB EntryX Refsource BID
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=183676X Refsource CONFIRMPatch
secunia.com/advisories/23939Third Party AdvisoryX Refsource SECUNIAVendor Advisory
support.avaya.com/elmodocs2/security/ASA-2006-176.htmX Refsource CONFIRM
secunia.com/advisories/20591Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.us-cert.gov/cas/techalerts/TA09-133A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
www.vupen.com/english/advisories/2009/1297VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/20638Third Party AdvisoryX Refsource SECUNIAVendor Advisory
securitytracker.com/id?1016522VDB EntryX Refsource SECTRACK
www.vupen.com/english/advisories/2007/0381VDB EntryX Refsource VUPENVendor Advisory
issues.rpath.com/browse/RPL-429X Refsource CONFIRM
secunia.com/advisories/21062Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDKSA-2006:099Vendor AdvisoryX Refsource MANDRIVA
www.debian.org/security/2006/dsa-1095Vendor AdvisoryX Refsource DEBIAN
security-tracker.debian.org/tracker/CVE-2006-0747Advisory

Related vulnerabilities

CVE-2018-6942alpinefreetype+72.08%8y ago13-02-2018 05:00An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file.CVE-2025-27363alpinefreetype+60KEV27.77%1y ago11-03-2025 13:28An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.CVE-2025-23022ubuntufreetype+30.24%1y ago10-01-2025 00:00FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.CVE-2020-15999alpinefreetype+67KEV63.89%5y ago03-11-2020 00:00Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2014-2240debianfreetype+17.01%12y ago12-03-2014 14:00Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.CVE-2014-2241canonicalubuntu_linux+21.90%12y ago18-03-2014 14:00The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.

All vulnerabilities infreetype

CVE-2006-0747: freetype Numeric Errors

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References