{"schemaVersion":3,"id":"CVE-2026-23865","aliases":["SUSE-SU-2026:20726-1","SUSE-SU-2026:20730-1","RHSA-2026:7933","UBUNTU-CVE-2026-23865","USN-8086-1","DEBIAN-CVE-2026-23865","DSA-6168-1","CGA-4f34-4gpc-qrwg","CGA-5ch6-4rpx-jc49","CGA-6636-2jh3-5c28","CGA-6h9q-pxvc-mm3w","CGA-6q5p-4c54-55mw","CGA-8gw2-rrf9-cfqv","CGA-8r4m-rp82-wvgr","CGA-96c9-grp5-9c9v","CGA-chq6-ccf6-999x","CGA-cmq9-6544-9rph","CGA-cwxp-cc7x-g83v","CGA-w4pm-j962-6j78","CGA-w6xp-5qcc-7mp5","CGA-x53w-p23j-7fr3","openSUSE-SU-2026:10289-1","CGA-3jv4-626j-5rqm","CGA-4r55-q6mw-jmc8","CGA-4vc9-f894-xp4v","CGA-4wqx-q59h-vv34","CGA-5479-2mhf-hchm","CGA-5h9f-v226-g46x","CGA-6944-hmjh-r4jq","CGA-7cfv-xcf6-cw6p","CGA-8hp4-663v-vrhh","CGA-9h95-3frq-c825","CGA-cqcx-mxjj-56px","CGA-fjgh-3qxx-j3jj","CGA-fvjc-xjvm-8f36","CGA-g2gf-hxmw-q3r7","CGA-g3pc-36g2-66f2","CGA-gcrh-wr8p-m736","CGA-gj2m-32pr-3p5j","CGA-jj75-p98v-5x53","CGA-jmcg-32vj-hcqh","CGA-m5mx-4qp4-w62p","CGA-mm25-xv48-696v","CGA-q2h4-f6gq-vvh7","CGA-q349-r7xh-73qx","CGA-qg37-jf2h-4w5w","CGA-rgr7-3483-jvch","CGA-rpv5-567m-mvcg","CGA-w233-66cr-hfgw","CGA-w89x-qm4r-9r4h","CGA-x2qv-8xfj-v5r2","CGA-x7hh-9phr-c67p","CGA-xhgm-7j32-rpgq","CGA-xrwj-27cv-373g"],"status":"published","duplicateOf":null,"title":null,"description":"An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.","dates":{"published":"2026-03-02T16:09:42.079Z","modified":"2026-03-04T00:16:54.590Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Red hat","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":4.6,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":4.6,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":4.6,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":4.6,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":4.6,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00147,"percentile":0.03535,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.005999999999999994,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00141},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00147,"percentile":0.03535}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00141,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00144,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00147,"percentile":0.03535}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-125","name":"Out-of-bounds Read","description":"The product reads data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/125.html"}],"affected":[{"vendor":"chainguard","product":"openjdk-21","name":"openjdk-21","label":"openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openjdk-21","purlType":"apk","versions":[{"text":"< 21.0.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 21.0.11-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openjdk-24","name":"openjdk-24","label":"openjdk-24","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openjdk-24","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openjdk-24-default-jdk","name":"openjdk-24-default-jdk","label":"openjdk-24-default-jdk","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openjdk-24-default-jdk","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openjdk-24-default-jvm","name":"openjdk-24-default-jvm","label":"openjdk-24-default-jvm","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openjdk-24-default-jvm","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openjdk-24-demos","name":"openjdk-24-demos","label":"openjdk-24-demos","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openjdk-24-demos","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openjdk-24-jre","name":"openjdk-24-jre","label":"openjdk-24-jre","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openjdk-24-jre","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openjdk-26","name":"openjdk-26","label":"openjdk-26","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openjdk-26","purlType":"apk","versions":[{"text":"< 26.0.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 26.0.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-21-cpu","name":"zulu-21-cpu","label":"zulu-21-cpu","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-21-cpu","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-21-cpu-dbg","name":"zulu-21-cpu-dbg","label":"zulu-21-cpu-dbg","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-21-cpu-dbg","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-21-cpu-default-jdk","name":"zulu-21-cpu-default-jdk","label":"zulu-21-cpu-default-jdk","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-21-cpu-default-jdk","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-21-cpu-default-jvm","name":"zulu-21-cpu-default-jvm","label":"zulu-21-cpu-default-jvm","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-21-cpu-default-jvm","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-21-cpu-demos","name":"zulu-21-cpu-demos","label":"zulu-21-cpu-demos","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-21-cpu-demos","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-21-cpu-doc","name":"zulu-21-cpu-doc","label":"zulu-21-cpu-doc","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-21-cpu-doc","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-21-cpu-jmods","name":"zulu-21-cpu-jmods","label":"zulu-21-cpu-jmods","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-21-cpu-jmods","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-21-cpu-jre","name":"zulu-21-cpu-jre","label":"zulu-21-cpu-jre","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-21-cpu-jre","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-25-cpu","name":"zulu-25-cpu","label":"zulu-25-cpu","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-25-cpu","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-25-cpu-dbg","name":"zulu-25-cpu-dbg","label":"zulu-25-cpu-dbg","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-25-cpu-dbg","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-25-cpu-default-jdk","name":"zulu-25-cpu-default-jdk","label":"zulu-25-cpu-default-jdk","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-25-cpu-default-jdk","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-25-cpu-default-jvm","name":"zulu-25-cpu-default-jvm","label":"zulu-25-cpu-default-jvm","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-25-cpu-default-jvm","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-25-cpu-demos","name":"zulu-25-cpu-demos","label":"zulu-25-cpu-demos","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-25-cpu-demos","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-25-cpu-doc","name":"zulu-25-cpu-doc","label":"zulu-25-cpu-doc","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-25-cpu-doc","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-25-cpu-jmods","name":"zulu-25-cpu-jmods","label":"zulu-25-cpu-jmods","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-25-cpu-jmods","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zulu-25-cpu-jre","name":"zulu-25-cpu-jre","label":"zulu-25-cpu-jre","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zulu-25-cpu-jre","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"openjdk-21","name":"openjdk-21","label":"openjdk-21","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/openjdk-21","purlType":"apk","versions":[{"text":"< 21.0.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 21.0.11-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"openjdk-24","name":"openjdk-24","label":"openjdk-24","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/openjdk-24","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"openjdk-24-default-jdk","name":"openjdk-24-default-jdk","label":"openjdk-24-default-jdk","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/openjdk-24-default-jdk","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"openjdk-24-default-jvm","name":"openjdk-24-default-jvm","label":"openjdk-24-default-jvm","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/openjdk-24-default-jvm","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"openjdk-24-demos","name":"openjdk-24-demos","label":"openjdk-24-demos","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/openjdk-24-demos","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"openjdk-24-jre","name":"openjdk-24-jre","label":"openjdk-24-jre","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/openjdk-24-jre","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"openjdk-26","name":"openjdk-26","label":"openjdk-26","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/openjdk-26","purlType":"apk","versions":[{"text":"< 26.0.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 26.0.1-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"freetype","name":"freetype","label":"freetype","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/freetype","purlType":"deb","versions":[{"text":"< 2.14.2+dfsg-1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.13.3+dfsg-1+deb13u1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.14.2+dfsg-1 | < 2.13.3+dfsg-1+deb13u1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"freetype","name":"freetype","label":"freetype","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/freetype","purlType":"deb","versions":[{"text":"< 2.13.2+dfsg-1ubuntu0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.13.3+dfsg-1ubuntu0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.13.2+dfsg-1ubuntu0.1 | < 2.13.3+dfsg-1ubuntu0.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-13","name":"openjdk-13","label":"openjdk-13","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-13","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-16","name":"openjdk-16","label":"openjdk-16","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-16","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-17","name":"openjdk-17","label":"openjdk-17","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-17","purlType":"deb","versions":[{"text":"< 17.0.19+10-1~18.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 17.0.19+10-1~20.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 17.0.19+10-1~22.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 17.0.19+10-1~24.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 17.0.19+10-1~25.10.2","noFixRecorded":false,"fixedIn":null},{"text":"< 17.0.19+10-1~26.04.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 17.0.19+10-1~18.04.2 | < 17.0.19+10-1~20.04.2 | < 17.0.19+10-1~22.04.2 | < 17.0.19+10-1~24.04.2 | < 17.0.19+10-1~25.10.2 | < 17.0.19+10-1~26.04.2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-17-crac","name":"openjdk-17-crac","label":"openjdk-17-crac","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-17-crac","purlType":"deb","versions":[{"text":"< 17.0.19+10-0ubuntu1~25.10.1","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 17.0.19+10-0ubuntu1~26.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 17.0.19+10-0ubuntu1~25.10.1 | All versions (No fix recorded) | < 17.0.19+10-0ubuntu1~26.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-18","name":"openjdk-18","label":"openjdk-18","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-18","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-21","name":"openjdk-21","label":"openjdk-21","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-21","purlType":"deb","versions":[{"text":"< 21.0.11+10-1~20.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 21.0.11+10-1~22.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 21.0.11+10-1~24.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 21.0.11+10-1~25.10.2","noFixRecorded":false,"fixedIn":null},{"text":"< 21.0.11+10-1~26.04.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 21.0.11+10-1~20.04.2 | < 21.0.11+10-1~22.04.2 | < 21.0.11+10-1~24.04.2 | < 21.0.11+10-1~25.10.2 | < 21.0.11+10-1~26.04.2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-21-crac","name":"openjdk-21-crac","label":"openjdk-21-crac","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-21-crac","purlType":"deb","versions":[{"text":"< 21.0.11+10-0ubuntu1~25.10.1","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 21.0.11+10-0ubuntu1~26.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 21.0.11+10-0ubuntu1~25.10.1 | All versions (No fix recorded) | < 21.0.11+10-0ubuntu1~26.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-25","name":"openjdk-25","label":"openjdk-25","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-25","purlType":"deb","versions":[{"text":"< 25.0.3+9-2~22.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 25.0.3+9-2~24.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 25.0.3+9-2~25.10.2","noFixRecorded":false,"fixedIn":null},{"text":"< 25.0.3+9-2~26.04.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.0.3+9-2~22.04.2 | < 25.0.3+9-2~24.04.2 | < 25.0.3+9-2~25.10.2 | < 25.0.3+9-2~26.04.2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-25-crac","name":"openjdk-25-crac","label":"openjdk-25-crac","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-25-crac","purlType":"deb","versions":[{"text":"< 25.0.3+9-0ubuntu1~25.10.1","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 25.0.3+9-0ubuntu1~26.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.0.3+9-0ubuntu1~25.10.1 | All versions (No fix recorded) | < 25.0.3+9-0ubuntu1~26.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-26","name":"openjdk-26","label":"openjdk-26","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-26","purlType":"deb","versions":[{"text":"< 26.0.1+8-2~25.10.2","noFixRecorded":false,"fixedIn":null},{"text":"< 26.0.1+8-2~26.04.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 26.0.1+8-2~25.10.2 | < 26.0.1+8-2~26.04.2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-8","name":"openjdk-8","label":"openjdk-8","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-8","purlType":"deb","versions":[{"text":"< 8u492-ga~us2-0ubuntu1~16.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 8u492-ga~us2-0ubuntu1~18.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 8u492-ga~us2-0ubuntu1~20.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 8u492-ga~us2-0ubuntu1~22.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 8u492-ga~us2-0ubuntu1~24.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 8u492-ga~us2-0ubuntu1~25.10.1","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 8u492-ga~us2-0ubuntu1~26.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8u492-ga~us2-0ubuntu1~16.04.1 | < 8u492-ga~us2-0ubuntu1~18.04.1 | < 8u492-ga~us2-0ubuntu1~20.04.1 | < 8u492-ga~us2-0ubuntu1~22.04.1 | < 8u492-ga~us2-0ubuntu1~24.04.1 | < 8u492-ga~us2-0ubuntu1~25.10.1 | All versions (No fix recorded) | < 8u492-ga~us2-0ubuntu1~26.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-9","name":"openjdk-9","label":"openjdk-9","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-9","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"openjdk-lts","name":"openjdk-lts","label":"openjdk-lts","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-lts","purlType":"deb","versions":[{"text":"< 11.0.31+11-1ubuntu1~18.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 11.0.31+11-1ubuntu1~20.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 11.0.31+11-1ubuntu1~22.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 11.0.31+11-1ubuntu1~24.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 11.0.31+11-1ubuntu1~25.10.2","noFixRecorded":false,"fixedIn":null},{"text":"< 11.0.31+11-1ubuntu1~26.04.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.0.31+11-1ubuntu1~18.04.2 | < 11.0.31+11-1ubuntu1~20.04.2 | < 11.0.31+11-1ubuntu1~22.04.2 | < 11.0.31+11-1ubuntu1~24.04.2 | < 11.0.31+11-1ubuntu1~25.10.2 | < 11.0.31+11-1ubuntu1~26.04.2","eol":null,"hubHref":null},{"vendor":"freetype","product":"freetype","name":"FreeType","label":"freetype","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.13.2, ≤ 2.13.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.14.0, ≤ 2.14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.13.2, ≤ 2.13.3 | ≥ 2.14.0, ≤ 2.14.1","eol":null,"hubHref":"/vendor/freetype/freetype"},{"vendor":"opensuse","product":"freetype2&distro=openSUSE Tumbleweed","name":"freetype2","label":"freetype2&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/freetype2&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 2.14.2-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.14.2-1.1","eol":null,"hubHref":null},{"vendor":"redhat","product":"freetype","name":"freetype","label":"freetype","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/freetype","purlType":"rpm","versions":[{"text":"< 0:2.14.3-1.hum1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.14.3-1.hum1","eol":null,"hubHref":null},{"vendor":"redhat","product":"freetype-demos","name":"freetype-demos","label":"freetype-demos","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/freetype-demos","purlType":"rpm","versions":[{"text":"< 0:2.14.3-1.hum1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.14.3-1.hum1","eol":null,"hubHref":null},{"vendor":"redhat","product":"freetype-devel","name":"freetype-devel","label":"freetype-devel","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/freetype-devel","purlType":"rpm","versions":[{"text":"< 0:2.14.3-1.hum1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.14.3-1.hum1","eol":null,"hubHref":null},{"vendor":"suse","product":"busybox&distro=SUSE Linux Micro 6.0","name":"busybox","label":"busybox&distro=SUSE Linux Micro 6.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/busybox&distro=SUSE Linux Micro 6.0","purlType":"rpm","versions":[{"text":"< 1.36.1-3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.36.1-3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"freetype2&distro=SUSE Linux Micro 6.0","name":"freetype2","label":"freetype2&distro=SUSE Linux Micro 6.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/freetype2&distro=SUSE Linux Micro 6.0","purlType":"rpm","versions":[{"text":"< 2.14.2-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.14.2-1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"freetype2&distro=SUSE Linux Micro 6.1","name":"freetype2","label":"freetype2&distro=SUSE Linux Micro 6.1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/freetype2&distro=SUSE Linux Micro 6.1","purlType":"rpm","versions":[{"text":"< 2.14.2-slfo.1.1_1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.14.2-slfo.1.1_1.1","eol":null,"hubHref":null}],"affectedCount":53,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.facebook.com/security/advisories/cve-2026-23865","label":"www.facebook.com/security/advisories/cve-2026-23865","hostname":"www.facebook.com","tags":["X Refsource CONFIRM","ARTICLE","REPORT","Advisory","Third Party Advisory"]},{"url":"https://gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c","label":"gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c","hostname":"gitlab.com","tags":["X Refsource CONFIRM","ARTICLE","FIX","Patch"]},{"url":"https://sourceforge.net/projects/freetype/files/freetype2/2.14.2/","label":"sourceforge.net/projects/freetype/files/freetype2/2.14.2/","hostname":"sourceforge.net","tags":["X Refsource CONFIRM","ARTICLE","REPORT","Advisory","Release Notes"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/03/8","label":"www.openwall.com/lists/oss-security/2026/03/03/8","hostname":"www.openwall.com","tags":["ARTICLE","Mailing List"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620726-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202620726-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1252148","label":"bugzilla.suse.com/1252148","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1259118","label":"bugzilla.suse.com/1259118","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23865","label":"www.suse.com/security/cve/CVE-2026-23865","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620730-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202620730-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7933","label":"access.redhat.com/errata/RHSA-2026:7933","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://images.redhat.com/","label":"images.redhat.com","hostname":"images.redhat.com","tags":["ARTICLE"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-23865","label":"access.redhat.com/security/cve/CVE-2026-23865","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://access.redhat.com/security/updates/classification/","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7933.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7933.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2443891","label":"bugzilla.redhat.com/show_bug.cgi?id=2443891","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23865","label":"www.cve.org/CVERecord?id=CVE-2026-23865","hostname":"www.cve.org","tags":["Advisory","REPORT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23865","label":"nvd.nist.gov/vuln/detail/CVE-2026-23865","hostname":"nvd.nist.gov","tags":["Advisory","Oval"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixJAVA","label":"www.oracle.com/security-alerts/cpuapr2026.html","hostname":"www.oracle.com","tags":["ARTICLE"]},{"url":"https://ubuntu.com/security/CVE-2026-23865","label":"ubuntu.com/security/CVE-2026-23865","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-8086-1","label":"ubuntu.com/security/notices/USN-8086-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8330-1","label":"ubuntu.com/security/notices/USN-8330-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8331-1","label":"ubuntu.com/security/notices/USN-8331-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8332-1","label":"ubuntu.com/security/notices/USN-8332-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8333-1","label":"ubuntu.com/security/notices/USN-8333-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8334-1","label":"ubuntu.com/security/notices/USN-8334-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8327-1","label":"ubuntu.com/security/notices/USN-8327-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8328-1","label":"ubuntu.com/security/notices/USN-8328-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8339-1","label":"ubuntu.com/security/notices/USN-8339-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8341-1","label":"ubuntu.com/security/notices/USN-8341-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-23865","label":"security-tracker.debian.org/tracker/CVE-2026-23865","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:10636-1","OPENSUSE-SU-2026:10637-1","OPENSUSE-SU-2026:10638-1","OPENSUSE-SU-2026:10639-1","OPENSUSE-SU-2026:10656-1","OPENSUSE-SU-2026:10728-1","OPENSUSE-SU-2026:10893-1","OPENSUSE-SU-2026:20943-1","OPENSUSE-SU-2026:20947-1","OPENSUSE-SU-2026:21362-1","RHSA-2026:22328","RHSA-2026:9254","RHSA-2026:9682","RHSA-2026:9683","RHSA-2026:9686","RHSA-2026:9689","RHSA-2026:9693","SUSE-SU-2026:22750-1","SUSE-SU-2026:22815-1","SUSE-SU-2026:2624-1"],"duplicates":[],"related":["CGA-52WQ-GPPQ-X56Q","OPENSUSE-SU-2026:10636-1","OPENSUSE-SU-2026:10637-1","OPENSUSE-SU-2026:10638-1","OPENSUSE-SU-2026:10639-1","OPENSUSE-SU-2026:10656-1","OPENSUSE-SU-2026:10728-1","OPENSUSE-SU-2026:10893-1","OPENSUSE-SU-2026:20943-1","OPENSUSE-SU-2026:20947-1","OPENSUSE-SU-2026:21362-1","SUSE-SU-2026:22750-1","SUSE-SU-2026:22815-1","SUSE-SU-2026:2624-1","USN-8327-1","USN-8328-1","USN-8330-1","USN-8331-1","USN-8332-1","USN-8333-1","USN-8334-1","USN-8339-1","USN-8341-1"]},"timeline":[{"kind":"published","date":"2026-03-02T16:09:42.079Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-03-04T00:16:54.590Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T12:20:48.136Z","stale":false,"partial":false}}