Published: 10/01/2025 Updated: 16/01/2025

Signed Integer Overflow in FreeType 2.8.1 Flex Processing

FreeType version 2.8.1 has a signed integer overflow issue in the cf2_doFlex function, located in cff/cf2intrp.c.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freetype freetype
freetype freetype 2.8.1

FreeType 281 has a signed integer overflow in cf2_doFlex in cff/cf2intrpc (CVE-2025-23022) An out of bounds write exists in FreeType versions 2130 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files The vulnerable code assigns a signed short value to an unsigned long and then adds a stat ...

CWE-190 CWE-190 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALAS-2025-2806.html https://www.first.org/epss https://gitlab.freedesktop.org/freetype/freetype/-/issues/1312 https://security-tracker.debian.org/tracker/CVE-2025-23022

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2025-23022

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect