Vulnerability CVE-2026-23865: Information

Description

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.

Severity: MEDIUM (5.3)

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23865

Published: March 2, 2026

Modified: May 1, 2026

Error type identifier: CWE-125

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
java-1.8.0-openjdk	sisyphus	1.8.0.492.b09-alt1	1.8.0.492.b09-alt2	ALT-PU-2026-7045-2	416783	Fixed
java-1.8.0-openjdk	p11	1.8.0.492.b09-alt2	1.8.0.482.b08-alt1	ALT-PU-2026-7063-1	416913	Testing
java-1.8.0-openjdk	c10f2	1.8.0.492.b09-alt2	1.8.0.482.b08-alt1	ALT-PU-2026-7065-1	416908	Testing
java-11-openjdk	sisyphus	11.0.31.0.11-alt1	11.0.31.0.11-alt1	ALT-PU-2026-7023-2	416780	Fixed
java-11-openjdk	p11	11.0.31.0.11-alt1	11.0.30.0.7-alt1	ALT-PU-2026-7029-1	416891	Testing
java-11-openjdk	c10f2	11.0.31.0.11-alt0.c10.1	11.0.30.0.7-alt0.c10.1	ALT-PU-2026-7031-1	416892	Testing
java-17-openjdk	sisyphus	17.0.19.0.10-alt1	17.0.19.0.10-alt1	ALT-PU-2026-7037-2	416778	Fixed
java-17-openjdk	p11	17.0.19.0.10-alt1	17.0.18.0.8-alt2	ALT-PU-2026-7041-1	416901	Testing
java-17-openjdk	c10f2	17.0.19.0.10-alt1	17.0.19.0.10-alt1	ALT-PU-2026-7043-2	416903	Fixed
java-21-openjdk	sisyphus	21.0.11.0.10-alt1	21.0.11.0.10-alt1	ALT-PU-2026-7033-2	416776	Fixed
java-21-openjdk	p11	21.0.11.0.10-alt1	21.0.11.0.10-alt1	ALT-PU-2026-7035-2	416897	Fixed
java-21-openjdk	p10	21.0.11.0.10-alt0.p10.1	21.0.11.0.10-alt0.p10.1	ALT-PU-2026-7125-2	416899	Fixed
java-21-openjdk	c10f2	21.0.11.0.10-alt0.p10.1	21.0.11.0.10-alt0.p10.1	ALT-PU-2026-7039-2	416898	Fixed
java-25-openjdk	sisyphus	25.0.3.0.9-alt1	25.0.3.0.9-alt1	ALT-PU-2026-6972-2	416777	Fixed
java-25-openjdk	p11	25.0.3.0.9-alt1	25.0.3.0.9-alt1	ALT-PU-2026-6980-2	416806	Fixed
libfreetype	sisyphus	2.14.2-alt1	2.14.3-alt1	ALT-PU-2026-7077-1	410097	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c	Patch
https://sourceforge.net/projects/freetype/files/freetype2/2.14.2/	Release Notes
https://www.facebook.com/security/advisories/cve-2026-23865	Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/03/03/8	Mailing List

Affected configurations:
1. cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*
  Start including
  2.13.2
  End including
  2.13.3
  cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*
  Start including
  2.14.0
  End including
  2.14.1

Version: v26.2.2