Freetype vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Freetype flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2025-27363 FreeType Out-of-Bounds WriteExploited since May 6, 2025 · CVSS 8.1

Latest high and critical flaws

• CVE-2025-27363 FreeType Out-of-Bounds WriteExploited · High 8.1 · Mar 11, 2025
• CVE-2022-27406 FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.High 7.5 · Apr 22, 2022
• CVE-2022-27405 FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.High 7.5 · Apr 22, 2022
• CVE-2022-27404 FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.Critical 9.8 · Apr 22, 2022
• CVE-2015-9381 FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.High 8.8 · Sep 3, 2019
• CVE-2015-9290 In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and liCritical 9.8 · Jul 30, 2019
• CVE-2017-8287 FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.Critical 9.8 · Apr 26, 2017
• CVE-2017-8105 FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1dCritical 9.8 · Apr 24, 2017
• CVE-2017-7864 FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.Critical 9.8 · Apr 14, 2017
• CVE-2017-7858 FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face function in sfnt/sfobCritical 9.8 · Apr 14, 2017
• CVE-2017-7857 FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var function in truetype/ttgxvar.c and tCritical 9.8 · Apr 14, 2017
• CVE-2016-10328 FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c.Critical 9.8 · Apr 14, 2017
• CVE-2016-10244 The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to caHigh 7.8 · Mar 6, 2017
• CVE-2014-9747 The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which alloHigh 7.5 · Jun 7, 2016
• CVE-2014-9746 The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in cid/cidload.c, (3) t42_parse_font_matrix function in type42/t42paCritical 9.8 · Jun 7, 2016
• CVE-2014-9663 The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, whHigh 7.5 · Feb 8, 2015
• CVE-2014-2240 Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (cHigh 7.5 · Mar 12, 2014
• CVE-2012-1144 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap wrHigh 9.3 · Apr 25, 2012
• CVE-2012-1142 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap wrHigh 9.3 · Apr 25, 2012
• CVE-2012-1141 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap reHigh 9.3 · Apr 25, 2012
• CVE-2012-1140 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap reHigh 9.3 · Apr 25, 2012
• CVE-2012-1139 Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of serHigh 9.3 · Apr 25, 2012
• CVE-2012-1138 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap reHigh 9.3 · Apr 25, 2012
• CVE-2012-1137 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap reHigh 9.3 · Apr 25, 2012
• CVE-2012-1136 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap wrHigh 9.3 · Apr 25, 2012