CVE-2025-23022
Publication date 10 January 2025
Last updated 11 February 2026
Ubuntu priority
Description
FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| freetype | 25.10 questing |
Not affected
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
Notes
hlibk
The patch that supposedly fixes the issue only wraps additions with macros that tag places where "overflow is expected and harmless". This vulnerability doesn't seem to have any security impact as the integer overflow was marked as safe by upstream.
0xnishit
fuzzing report for a seven year old copy of FreeType https://gitlab.freedesktop.org/freetype/freetype/-/issues/1312 version <=2.8.1 (which is bionic or earlier) might be affected
mdeslaur
need to check if commit listed below fixes the issue, as suggested in the upstream bug.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
4.0 · Medium
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | Low |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |