Loading vulnerability…
Resource exhaustion in FreeType CID font loader
CVE-2026-95512 is a resource-exhaustion vulnerability in FreeType's CID font loader. Processing a specially crafted CID-keyed font can trigger repeated allocations and decryptions of subroutine data across multiple font dictionaries, causing excessive memory and CPU consumption. An attacker can deliver content embedding or referencing such a font and induce a user to open it, potentially causing the application or service processing the font to hang or terminate. FreeType 2.15.0 includes a fix; the complete affected-version range is not established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can exhaust memory and CPU resources, causing denial of service through application hangs, crashes, or termination of the service processing the font. The vulnerability is rated Medium with a CVSS v3 base score of 5.5 and high availability impact. No confidentiality or integrity impact is identified.
If you can’t patch tonight, do this now.
No vendor-specific temporary workaround is documented. Pending patching, avoid processing untrusted CID-keyed fonts or content embedding or referencing them where feasible. Isolate font-processing workloads and enforce memory, CPU, and execution-time limits to contain resource exhaustion; these measures do not correct the underlying flaw.
Patch, then assume compromise.
Upgrade to FreeType 2.15.0 or install the applicable vendor-backported security update. Ubuntu USN-8881-1 identifies fixed libfreetype6 versions as 2.14.2+dfsg-1ubuntu0.2 for Ubuntu 26.04 LTS, 2.13.2+dfsg-1ubuntu0.2 for Ubuntu 24.04 LTS, and 2.11.1+dfsg-1ubuntu0.4 for Ubuntu 22.04 LTS. For Echo packages, update FreeType and related packages to 2.13.3+dfsg-1+e6 or later. For affected Tanzu Jammy stemcells, deploy the applicable security-fixed 1.9041.x build; consult vendor release guidance for the exact patched build.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.