FreeType 2.15.0 Fixes Three Flaws in Font Processing and Decompression

FreeType 2.15.0 has been released with fixes for three reported vulnerabilities in the font-processing library. CVE-2026-95512 involves excessive CPU consumption when processing CID-format fonts, while CVE-2026-50811 involves an out-of-bounds read in font-variation functions. CVE-2026-27171 affects zlib-derived decompression code included in FreeType.

Organizations using FreeType should identify affected deployments, including applications that bundle the library, and prioritize updating to 2.15.0 or vendor-provided packages containing the fixes, particularly where untrusted fonts are processed. The reports contain substantial encoding corruption, limiting confidence in the precise vulnerability mechanisms and impacts; affected-version ranges, exploitability, and exploitation status are not established by the supplied references.