CVE-2026-95512 Overview
A resource exhaustion flaw exists in FreeType's CID-keyed font loader. A remote attacker can exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. The malformed font triggers repeated allocations and decryptions of subroutine data across multiple font dictionaries. This behavior drives excessive memory and CPU consumption in any application or service that processes the font. The result is a denial of service (DoS) condition that can hang or terminate the affected process. The vulnerability is tracked under [CWE-400: Uncontrolled Resource Consumption].
Critical Impact
A crafted CID-keyed font processed by FreeType exhausts memory and CPU, causing applications and services that render fonts to hang or crash.
Affected Products
- FreeType font rendering library (CID font loader component)
- Red Hat Enterprise Linux (addressed in advisory RHSA-2026:74952)
- Downstream applications and services that embed FreeType for font parsing
Discovery Timeline
- 2026-10-02 - CVE-2026-95512 published to the National Vulnerability Database (NVD)
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-95512
Vulnerability Analysis
The defect resides in FreeType's handler for CID-keyed PostScript fonts. CID fonts organize glyphs across multiple font dictionaries (FDArray), each with its own subroutine data. When FreeType parses a crafted CID font, it repeatedly allocates buffers and decrypts subroutine data for every dictionary referenced. An attacker shapes the font so these per-dictionary operations expand without bound. CPU time grows with the decryption work, and heap usage grows with each new allocation. Applications that process the font — browsers, document viewers, print pipelines, or server-side rendering services — stall or terminate under the load.
Root Cause
The root cause is uncontrolled resource consumption during CID subroutine processing. FreeType does not cap the number of allocations and decryption passes performed across font dictionaries. A font that declares many dictionaries, or inflates per-dictionary subroutine payloads, forces repeated expensive operations with no upstream validation.
Attack Vector
Exploitation requires user interaction with attacker-controlled content. A victim opens a document, web page, or file that embeds or references the crafted CID font. The attack vector is local in CVSS terms because the font is processed by a local application, but delivery can occur through any channel that supplies font data to a FreeType consumer. No privileges or authentication are required on the target system. The impact is limited to availability; confidentiality and integrity are not affected. Technical details and the upstream fix are documented in the GitLab FreeType commit f3ca71c.
Detection Methods for CVE-2026-95512
Indicators of Compromise
- Font-rendering processes (for example, browsers, document viewers, or print services) consuming abnormally high CPU or memory while parsing a single font asset.
- Application crashes, hangs, or out-of-memory terminations correlated with the loading of a CID-keyed PostScript font.
- Unexpected CID font files arriving through email attachments, downloads, or embedded web content.
Detection Strategies
- Inventory systems and applications linking against vulnerable FreeType versions and prioritize those exposed to untrusted font input.
- Monitor process telemetry for sustained CPU saturation or rapid memory growth in font-handling processes.
- Inspect inbound documents and web content for CID-keyed fonts with abnormally large FDArray structures or oversized subroutine data.
Monitoring Recommendations
- Alert on repeated restarts or kills of rendering processes such as browsers, PDF readers, and server-side font pipelines.
- Track resource ceilings (cgroup limits, container OOM events) for services that process user-supplied documents or fonts.
- Correlate font-file retrieval events with downstream performance degradation to surface targeted DoS attempts.
How to Mitigate CVE-2026-95512
Immediate Actions Required
- Apply the FreeType security update distributed by your operating system vendor, including the Red Hat update in RHSA-2026:74952.
- Restart all services and user applications that link against FreeType so the patched library is loaded.
- Restrict ingestion of untrusted font files in server-side rendering, conversion, and print services until patches are deployed.
Patch Information
The upstream fix is available in the FreeType repository as commit f3ca71c9900fe860849b3163a6e2c1e765b291d9. Red Hat ships the fix through RHSA-2026:74952; see the Red Hat CVE page for CVE-2026-95512 and Red Hat Bugzilla #2462295 for distribution-specific package versions.
Workarounds
- Enforce resource limits (CPU time, memory ceilings, cgroups) on processes that render fonts from untrusted sources.
- Sandbox font-rendering workloads so a hang or termination does not disrupt the broader service.
- Block or filter CID-keyed PostScript fonts in email gateways and web proxies where they are not business-required.
# Example: constrain a font-processing service with systemd resource limits
[Service]
MemoryMax=512M
CPUQuota=50%
TasksMax=256
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.