Tetrak
GitHub ↗
Security · FreeType

An OpenType variable font's variation tables over-read in FreeType

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts.

Advisory
CVE-2026-23865
Library
FreeType, freetype on Debian
Published
Severity
5.3 out of 10, as published
Affected
FreeType 2.13.2 and 2.13.3
Fixed in
2.14.2
Reaches you
by opening a file

What triggers it

Rendering a PDF whose embedded OpenType variable font carries crafted HVAR, VVAR or MVAR tables.

What sillybos does

Needs decoding to detect

The flaw is in the pixel data or the compressed stream, which only a decoder can see. Nothing before the decoder can refuse it; updating the decoder is the fix.

Reached by rendering, through an embedded variable font, as CVE-2025-27363; nothing is filtered. Embedded fonts are not unusual: every searchable PDF carries one for its text layer, Tetrak OCR's own output included (all thirty-eight PDFs in its checkouts), so a policy refusing fonts, which pdffonts could support, would refuse the very files the check exists to protect. A flaw in the font program is out of this library's reach; the boxed process is the defence.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Moved from B2 to C on 2026-11-02, with the finding above.

How to protect yourself

In general. Upgrade to FreeType 2.14.2.

Specifically. Render in a boxed process; an image-only PDF carries no font.

The general advice applies to every row here.

Sources