5.3

CVE-2026-23865: freetype Out-of-bounds Read

CVSS: 5.3v3.1MediumAnalyzed
AliasesSUSE-SU-2026:20726-1SUSE-SU-2026:20730-1RHSA-2026:7933
Published 02-03-2026Last modified 04-03-2026
Open JSON

Vulnerability summary

CVE-2026-23865 is a medium (CVSS 5.3) Out-of-bounds Read vulnerability in freetype. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.5% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.15%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 20 · Related 23
OPENSUSE-SU-2026:10636-1OPENSUSE-SU-2026:10637-1OPENSUSE-SU-2026:10638-1OPENSUSE-SU-2026:10639-1OPENSUSE-SU-2026:10656-1OPENSUSE-SU-2026:10728-1

Timeline

  1. 02-03-2026
    PublishedVulnerability first disclosed.
  2. 04-03-2026
    Last modifiedVulnerability information updated.

Description

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

+0.01 pp

From 0.14% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard23 products
  • openjdk-21< 21.0.11-r0
  • openjdk-24All versions (No fix recorded)
  • openjdk-24-default-jdkAll versions (No fix recorded)
  • openjdk-24-default-jvmAll versions (No fix recorded)
  • openjdk-24-demosAll versions (No fix recorded)
Ubuntu14 products
  • freetype< 2.13.2+dfsg-1ubuntu0.1 | < 2.13.3+dfsg-1ubuntu0.1
  • openjdk-13All versions (No fix recorded)
  • openjdk-16All versions (No fix recorded)
  • openjdk-17< 17.0.19+10-1~18.04.2 | < 17.0.19+10-1~20.04.2 | < 17.0.19+10-1~22.04.2 | < 17.0.19+10-1~24.04.2 | < 17.0.19+10-1~25.10.2 | < 17.0.19+10-1~26.04.2
  • openjdk-17-crac< 17.0.19+10-0ubuntu1~25.10.1 | All versions (No fix recorded) | < 17.0.19+10-0ubuntu1~26.04.1
Wolfi7 products
  • openjdk-21< 21.0.11-r0
  • openjdk-24All versions (No fix recorded)
  • openjdk-24-default-jdkAll versions (No fix recorded)
  • openjdk-24-default-jvmAll versions (No fix recorded)
  • openjdk-24-demosAll versions (No fix recorded)
Redhat3 products
  • freetype< 0:2.14.3-1.hum1
  • freetype-demos< 0:2.14.3-1.hum1
  • freetype-devel< 0:2.14.3-1.hum1
Suse3 products
  • busybox&distro=SUSE Linux Micro 6.0< 1.36.1-3.1
  • freetype2&distro=SUSE Linux Micro 6.0< 2.14.2-1.1
  • freetype2&distro=SUSE Linux Micro 6.1< 2.14.2-slfo.1.1_1.1
Debian1 product
  • freetype< 2.14.2+dfsg-1 | < 2.13.3+dfsg-1+deb13u1
Freetype1 product
  • freetype≥ 2.13.2, ≤ 2.13.3 | ≥ 2.14.0, ≤ 2.14.1
Opensuse1 product
  • freetype2&distro=openSUSE Tumbleweed< 2.14.2-1.1

8 vendors · 53 products

References

30 links
Show all 30 references