CVE-2017-7857

Critical

Published: 14/04/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var function and the sfnt_init_face function.

Risk Assessment

Exploitation of this vulnerability may lead to unauthorized memory access, potentially resulting in arbitrary code execution or application crashes.

Recommendation

It is recommended to update FreeType to a version after 2017-03-08 to mitigate this vulnerability.

Original NVD description (English source)

FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face function in sfnt/sfobjs.c.