CVE-2026-23865 Integer overflow in FreeType
An integer overflow in FreeType allows out-of-bounds reads when parsing variable fonts, potentially leading to information disclosure or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-23865?
CVE-2026-23865 is a medium-severity vulnerability in Freetype Freetype, published on 2 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.
Weakness: CWE-125
Which versions are affected by CVE-2026-23865?
3 open source packages ship an affected version, including java, java-min and jre. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
java Bitnami | From 9.0.0 | 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1 |
java-min Bitnami | From 9.0.0 | 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1 |
jre Bitnami | From 9.0.0 | 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1 |
Linux distribution packages (7)
freetype Red Hat:hummingbird:1 | All versions | 0:2.14.3-1.hum1 |
freetype-demos Red Hat:hummingbird:1 | All versions | 0:2.14.3-1.hum1 |
freetype-devel Red Hat:hummingbird:1 | All versions | 0:2.14.3-1.hum1 |
busybox SUSE:Linux Micro 6.0 | All versions | 1.36.1-3.1 |
freetype2 SUSE:Linux Micro 6.0 | All versions | 2.14.2-1.1 |
freetype2 SUSE:Linux Micro 6.1 | All versions | 2.14.2-slfo.1.1_1.1 |
freetype2 openSUSE:Tumbleweed | All versions | 2.14.2-1.1 |
Products include Freetype Freetype.
How do I fix CVE-2026-23865?
Upgrade java to a fixed version for your release line: 11.0.31, 17.0.19, 21.0.11 or 25.0.3.
Is CVE-2026-23865 being exploited?
There is no known exploitation of CVE-2026-23865 in the wild and no public exploit code.
Other vulnerabilities in Freetype Freetype
Sources
Also known as AZL-78518, AZL-78701, BELL-CVE-2026-23865, BIT-java-2026-23865, BIT-java-min-2026-23865, BIT-jre-2026-23865 and 42 more.