« Volver al listado

CVE-2026-23865

Estado: AnalizadaMedia (5.3)—

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Freetype — Freetype

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-23865",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-23865",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-02T16:25:34.989518Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve-assign@fb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve-assign@fb.com",
      "affectedData": [
        {
          "vendor": "FreeType",
          "product": "FreeType",
          "versions": [
            {
              "status": "affected",
              "version": "2.13.2",
              "versionType": "semver",
              "lessThanOrEqual": "2.13.3"
            },
            {
              "status": "affected",
              "version": "2.14.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.14.1"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-03-02T17:16:32.100",
  "references": [
    {
      "url": "https://gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c",
      "tags": [
        "Patch"
      ],
      "source": "cve-assign@fb.com"
    },
    {
      "url": "https://sourceforge.net/projects/freetype/files/freetype2/2.14.2/",
      "tags": [
        "Release Notes"
      ],
      "source": "cve-assign@fb.com"
    },
    {
      "url": "https://www.facebook.com/security/advisories/cve-2026-23865",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve-assign@fb.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/03/03/8",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2."
    },
    {
      "lang": "es",
      "value": "Un desbordamiento de entero en la función tt_var_load_item_variation_store de la librería Freetype en las versiones 2.13.2 y 2.13.3 puede permitir una operación de lectura fuera de límites al analizar tablas HVAR/VVAR/MVAR en fuentes variables OpenType. Este problema está solucionado en la versión 2.14.2."
    }
  ],
  "lastModified": "2026-06-17T10:22:13.563",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31E09E2F-28D3-440A-ADA4-D58EEF53733B",
              "versionEndIncluding": "2.13.3",
              "versionStartIncluding": "2.13.2"
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57620D53-213B-4593-BC11-37A948627473",
              "versionEndIncluding": "2.14.1",
              "versionStartIncluding": "2.14.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve-assign@fb.com"
}