CVE-2026-49919
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the tt_face_colr_blend_layer function of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Risk Assessment
Risk of remote code execution and privilege escalation on the system, potentially allowing an attacker to take control of the device.
Recommendation
Apply the vendor-provided patch that fixes the integer overflow in the tt_face_colr_blend_layer function.
Other vulnerabilities in FreeType
See all- CVE-2014-9747High
The t42_parse_encoding function in FreeType before version 2.5.4 does not properly update the current position for immediates-only mode, allowing remote attackers to cause a denial of service (infinite loop) via a Type42 font.
- CVE-2014-9674High
The Mac_Read_POST_Resource function in FreeType before version 2.5.4 does not validate length values, which can lead to integer overflow and heap-based buffer overflow, allowing remote attackers to cause a denial of service.
- CVE-2014-9668High
The woff_open_font function in FreeType before version 2.5.4 performs offset and length calculations without restricting length values, which can lead to integer overflow and heap-based buffer overflow.
- CVE-2014-9665High
The Load_SBit_Png function in FreeType before version 2.5.4 does not restrict the rows and pitch values of PNG data, allowing remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) by embedding a PNG file in a .ttf font file.
- CVE-2014-9663High
The tt_cmap4_validate function in FreeType before version 2.5.4 validates a certain length field before that field's value is completely calculated, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.
- CVE-2014-9662High
In FreeType versions before 2.5.4, return values of point-allocation functions are not validated, which can lead to a heap-based buffer overflow. Remote attackers may exploit this to cause a denial of service or possibly have unspecified other impact via a crafted OTF font.
- CVE-2014-9661High
In FreeType before version 2.5.4, the type42/t42parse.c file does not consider that scanning can be incomplete without triggering an error, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.
- CVE-2014-9660High
The _bdf_parse_glyphs function in FreeType before version 2.5.4 does not properly handle a missing ENDCHAR record, which can lead to denial of service (NULL pointer dereference) or other unspecified impacts via a crafted BDF font.
- CVE-2014-9659High
The CFF CharString interpreter in FreeType before version 2.5.4 has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font.
- CVE-2014-9658High
The tt_face_load_kern function in FreeType before version 2.5.4 enforces an incorrect minimum table length, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.
Original NVD description (English source)
In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS