Loading vulnerability…
Out-of-bounds read in FreeType TT_Get_Var_Design
CVE-2026-50811 is an out-of-bounds read vulnerability in FreeType's TT_Get_Var_Design implementation, used by FT_Get_Var_Design_Coordinates to retrieve font variation design coordinates. It affects FreeType 2.14.3 and versions preceding the fixing commit. Triggering the vulnerable implementation can result in reads beyond valid memory boundaries, potentially causing application crashes or unintended disclosure of memory contents. FreeType 2.15.0 includes the fix.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An out-of-bounds read may crash an application using the affected FreeType functionality, causing denial of service. Unintended disclosure of process memory is also a potential consequence, but an attacker-observable disclosure mechanism and its scope are not established.
If you can’t patch tonight, do this now.
Until patched versions can be deployed, reduce exposure by avoiding processing untrusted or externally supplied font files with vulnerable FreeType builds, especially fonts containing variation data that may exercise TT_Get_Var_Design via FT_Get_Var_Design_Coordinates. Where possible, sandbox applications that parse fonts and restrict crash impact.
Patch, then assume compromise.
Upgrade FreeType to version 2.15.0 or another build containing commit 5a280ecde6f324de0d226261036e736e0cb49a71. For applications bundling FreeType, update the bundled library or install an application release incorporating the fix. Tanzu Hub deployments covered by the vendor advisory should upgrade to release 11.0.0, which includes the listed security fixes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.