Loading vulnerability…
CVE-2020-15999 is a heap-based buffer overflow in the FreeType font rendering library, in the Load_SBit_Png function used to process embedded PNG images in bitmap glyph data such as the TrueType sbix table. The flaw is caused by improper handling of image dimensions, including truncation of PNG width and height values from 32-bit to 16-bit integers, which can produce an integer overflow condition that leads to undersized allocation and subsequent out-of-bounds heap writes during bitmap processing. In Google Chrome prior to 86.0.4240.111, the vulnerability was reachable through crafted HTML content that caused the browser renderer to load a malicious font, enabling heap corruption in the renderer process. The issue was also noted as related in bug class and code location to an earlier FreeType vulnerability affecting the same function.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a proof-of-concept (PoC) for CVE-2020-15999, a heap buffer overflow vulnerability in the FreeType library used by Google Chrome and Chromium. The exploit demonstrates how a specially crafted TrueType font file with a malicious SBIX table can be loaded into a browser via CSS or JavaScript to trigger the vulnerability. The repository contains three files: a large README.md with detailed notes, an index.html file that loads the font and displays a sample glyph, and a style.css file that defines the @font-face rule referencing several font files, including the malicious one. The PoC is not weaponized and does not provide a full exploit chain, but it can crash vulnerable browsers and demonstrates the attack vector. The main fingerprintable endpoint is the crafted font file (arialnew.ttf.sbix.ttf) referenced in the CSS. The repository is intended for research and demonstration purposes, and credits the original vulnerability discovery to Google Project Zero.
This repository provides a proof-of-concept (POC) exploit for CVE-2020-15999, a vulnerability in the FreeType library used by Google Chrome and other products. The repository contains a Bash script ('run.sh') and a README. The script automates the installation of dependencies, builds specific versions of libpng and freetype2 from source, and sets up the environment with AddressSanitizer for debugging. It then attempts to trigger the vulnerability by running the 'ftview' tool on a crafted font file ('font.ttf'). The exploit is local and requires the user to provide the necessary source archives and font file. No remote or network endpoints are involved. The repository is structured as a simple POC for research or demonstration purposes.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Freetype heap buffer overflow in Load_SBit_Png caused by integer truncation of PNG-embedded font dimensions, used to exploit the Chrome renderer in multiple in-the-wild exploit chains.
A heap-based buffer overflow in the FreeType font-loading library that can be exploited through Chrome to achieve renderer code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.