CVE-2026-50811: FreeType Buffer Overflow Vulnerability

CVE-2026-50811 Overview

CVE-2026-50811 is an out-of-bounds read vulnerability [CWE-125] in the FreeType 2 font rendering library. The flaw exists in the TT_Get_Var_Design implementation within src/truetype/ttgxvar.c, which is used by FT_Get_Var_Design_Coordinates when processing TrueType GX variable fonts. Affected versions include FreeType 2.14.3 and all builds prior to commit 5a280ecde6f324de0d226261036e736e0cb49a71. An attacker can trigger the condition by supplying a crafted variable font, causing the library to read memory outside allocated buffers. FreeType is embedded across browsers, operating systems, PDF renderers, and mobile platforms, so exposure is broad.

Critical Impact
Remote attackers can trigger out-of-bounds memory reads through crafted TrueType variable fonts, leading to information disclosure and potential process crashes in any application linking FreeType.

Affected Products

FreeType 2.14.3
FreeType versions prior to commit 5a280ecde6f324de0d226261036e736e0cb49a71
Applications and operating systems bundling vulnerable FreeType builds (browsers, document renderers, desktop environments)

Discovery Timeline

2026-07-07 - CVE-2026-50811 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-50811

Vulnerability Analysis

The vulnerability resides in TT_Get_Var_Design, the routine backing FT_Get_Var_Design_Coordinates. This function returns the current design coordinates of a variation font instance. When the routine handles the extras structure without properly zero-initializing it, downstream code iterates over memory beyond the allocated axis count. The result is a read of uninitialized or adjacent heap data controlled by the layout of surrounding allocations.

Because FreeType is invoked whenever an application renders fonts, the vulnerable path can be reached by opening a document, visiting a web page, or loading an application resource that references an attacker-supplied TrueType variable font. The primary impact is confidentiality loss through leaked process memory. Secondary effects include denial of service when the read touches unmapped pages.

Root Cause

The root cause is missing initialization of the extras structure within TT_Get_Var_Design combined with reliance on FT_MM_Var and FT_Var_Axis fields to bound subsequent reads. When those fields do not accurately describe allocated storage, iteration walks past the buffer. The upstream patch removes the unbounded traversal and zeroes extras to eliminate the dangling reference to axis metadata.

Attack Vector

Exploitation is remote and requires no privileges or user interaction beyond consuming a malicious font. Delivery vectors include:

Web pages embedding malicious @font-face variable font resources
PDF or office documents referencing crafted TrueType variable fonts
Application file formats that pass untrusted font streams to FreeType

// Source: https://github.com/freetype/freetype/commit/5a280ecde6f324de0d226261036e736e0cb49a71
// Patch to src/truetype/ttgxvar.c - TT_Get_Var_Design
     TT_Face       ttface = (TT_Face)face;
     FT_Error      error  = FT_Err_Ok;
     GX_Blend      blend;
-    FT_MM_Var*    mmvar;
-    FT_Var_Axis*  a;
-    FT_UInt       i, nc;
+    FT_UInt       i;


     if ( !ttface->blend )

The patch removes the mmvar, axis pointer a, and axis count nc locals that participated in the out-of-bounds iteration, and zeroes the extras structure so no stale metadata is consulted during coordinate retrieval.

Detection Methods for CVE-2026-50811

Indicators of Compromise

Application crashes or segmentation faults in processes linked against libfreetype when parsing font resources
Anomalous font files delivered via web downloads, email attachments, or document embeds referencing TrueType GX variation tables
Sanitizer reports (AddressSanitizer, Valgrind) flagging out-of-bounds reads in TT_Get_Var_Design or FT_Get_Var_Design_Coordinates

Detection Strategies

Inventory installed FreeType versions across endpoints and servers using software composition analysis and package managers such as dpkg, rpm, and pkg-config --modversion freetype2
Enable fuzzing or sanitizer builds for internal applications that call FT_Get_Var_Design_Coordinates to surface exploitation attempts
Alert on process crashes with call stacks containing ttgxvar.c symbols

Monitoring Recommendations

Monitor endpoint logs for repeated crashes of browsers, PDF viewers, and office suites that suggest malformed font processing
Track network telemetry for downloads of .ttf, .otf, and .woff2 files from untrusted origins, correlating with subsequent application faults
Review vendor security bulletins from Linux distributions and OS vendors to identify when downstream FreeType packages are updated

How to Mitigate CVE-2026-50811

Immediate Actions Required

Update FreeType to a build that includes commit 5a280ecde6f324de0d226261036e736e0cb49a71 or later
Apply distribution security updates for packages that statically or dynamically link FreeType
Rebuild and redeploy internal applications that vendor FreeType from source

Patch Information

The fix is committed upstream in both the Freetype GitHub Commit Log and the Freetype GitLab Commit Log. Tracking discussion is available in Freetype GitLab Issue #1436. Downstream distributions typically ship the fix as a point release of the freetype or freetype2 package.

Workarounds

Restrict rendering of untrusted TrueType variable fonts in browsers and document viewers where policy allows
Sandbox font parsing processes using seccomp, AppArmor, or platform equivalents to contain information disclosure
Disable web font loading through browser policy for high-risk user populations until patches are deployed

bash

# Verify installed FreeType version on Debian/Ubuntu
dpkg -l | grep libfreetype
apt-cache policy libfreetype6

# Verify on RHEL/Fedora
rpm -q freetype

# Query pkg-config for the linked version
pkg-config --modversion freetype2