Tetrak
GitHub ↗
Security · FreeType

A CID-keyed font makes FreeType allocate and decrypt without end

A flaw was found in FreeType, specifically within its CID font loader.

Advisory
CVE-2026-95512
Library
FreeType, freetype on Debian
Published
Severity
5.5 out of 10, as published
Affected
FreeType, as packaged; see the upstream record
Fixed in
see the upstream record
Reaches you
by opening a file

What triggers it

Rendering a PDF whose embedded CID-keyed font repeats subroutine data across many font dictionaries.

What sillybos does

Needs decoding to detect

The flaw is in the pixel data or the compressed stream, which only a decoder can see. Nothing before the decoder can refuse it; updating the decoder is the fix.

Reached by rendering, through an embedded CID-keyed font; nothing is filtered. A time limit on the renderer bounds the cost. Embedded fonts are not unusual: every searchable PDF carries one for its text layer, Tetrak OCR's own output included (all thirty-eight PDFs in its checkouts), so a policy refusing fonts, which pdffonts could support, would refuse the very files the check exists to protect. A flaw in the font program is out of this library's reach; the boxed process is the defence.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Moved from B2 to C on 2026-11-02, with the finding above.

How to protect yourself

In general. Upgrade FreeType to a version that has the fix; the upstream record names it.

Specifically. Render in a boxed process with a time limit.

The general advice applies to every row here.

Sources