6.5

CVE-2026-50811: freetype Out-of-bounds Read

CVSS: 6.5v3.1MediumDeferred
AliasesMGASA-2026-0472SUSE-SU-2026:22922-1SUSE-SU-2026:23074-1
Published 07-07-2026Last modified 08-07-2026
Open JSON

Vulnerability summary

CVE-2026-50811 is a medium (CVSS 6.5) Out-of-bounds Read vulnerability in freetype. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.47%
0%100%
Low · +0.20 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 3 · Related 3
OPENSUSE-SU-2026:21362-1SUSE-SU-2026:22750-1SUSE-SU-2026:22815-1

Timeline

  1. 07-07-2026
    PublishedVulnerability first disclosed.
  2. 08-07-2026
    Last modifiedVulnerability information updated.

Description

An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.47%

Chance of exploitation in the next 30 days

Percentile

40%

Versus all other CVEs

30-day change

+0.20 pp

From 0.28% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.47%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (gitlab.freedesktop.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat3 products
  • freetype< 0:2.14.3-1.2.hum1
  • freetype-demos< 0:2.14.3-1.2.hum1
  • freetype-devel< 0:2.14.3-1.2.hum1
Suse2 products
  • freetype2&distro=SUSE Linux Micro 6.0< 2.14.3-1.1
  • freetype2&distro=SUSE Linux Micro 6.1< 2.14.3-slfo.1.1_1.1
Debian1 product
  • freetype< 2.14.3+dfsg-2
Mageia1 product
  • freetype2< 2.14.2-1.1.mga10.tainted
Opensuse1 product
  • freetype2&distro=openSUSE Tumbleweed< 2.14.3-1.1
Ubuntu1 product
  • freetypeAll versions (No fix recorded) | < 2.14.2+dfsg-1ubuntu0.1

6 vendors · 9 products

References

24 links
Show all 24 references