CVE-2026-50811

Name	CVE-2026-50811
Description	An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1141704

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
freetype (PTS)	bullseye	2.10.4+dfsg-1+deb11u1	fixed
	bullseye (security)	2.10.4+dfsg-1+deb11u2	fixed
	bookworm, bookworm (security)	2.12.1+dfsg-5+deb12u4	fixed
	trixie (security), trixie	2.13.3+dfsg-1+deb13u1	fixed
	forky	2.14.3+dfsg-1	vulnerable
	sid	2.14.3+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
freetype	source	bullseye	(not affected)
freetype	source	bookworm	(not affected)
freetype	source	trixie	(not affected)
freetype	source	(unstable)	2.14.3+dfsg-2	1141704

Notes

[trixie] - freetype <not-affected> (Vulnerable code introduced later)
[bookworm] - freetype <not-affected> (TT_Get_Var_Design OOB read introduced in 2.14.0; shipped code uses safe coords[i]=0)
[bullseye] - freetype <not-affected> (TT_Get_Var_Design OOB read introduced in 2.14.0; shipped code uses safe coords[i]=0)
https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1436
Introduced with: https://gitlab.freedesktop.org/freetype/freetype/-/commit/f64c7db2fee3f5304df1cd722df72699736118f3 ( VER-2-14-0 )
Fixed by: https://gitlab.freedesktop.org/freetype/freetype/-/commit/8fa928f1617aba65f45b00f0dcb109f077b7741e
Fixed by: https://gitlab.freedesktop.org/freetype/freetype/-/commit/5a280ecde6f324de0d226261036e736e0cb49a71