Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-50811 EUVD-2026-42157GHSA-v5fr-wv7c-jq2m

An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/tr…

Published Jul 7, 2026 · Updated Jul 8, 2026 · Assigned by mitre

Package: freetype Package: freetype Ecosystem: Debian Ecosystem: Ubuntu

Description

An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 freetype 2.14.3+dfsg-2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS freetype 2.14.2+dfsg-1ubuntu0.1 USN-8562-1
Ubuntu 25.10 freetype No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 freetype +2 2.14.3-1.2.hum1 RHSA-2026:36841

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 freetype2 2.14.3-160000.1.1 SUSE-SU-2026:22815-1
SLES 16.0 freetype2 2.14.3-160000.1.1 SUSE-SU-2026:22815-1
SLE Micro 6.2 freetype2 2.14.3-160000.1.1 SUSE-SU-2026:22750-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 freetype2 2.14.3-slfo.1.1_1.1 SUSE-SU-2026:23074-1
SLE Micro 6.0 freetype2 2.14.3-1.1 SUSE-SU-2026:22922-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed freetype2 2.14.3-1.1 openSUSE-SU-2026:11257-1
openSUSE Leap 16.0 ft2demos +1 2.14.3-160000.1.1 openSUSE-SU-2026:21362-1

Advisories 9

References