VDB
BIT-java-min-2026-23865
BIT-java-min-2026-23865
PUBLISHED
CVSS 5.300000190734863 MEDIUM
An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.
Risk Scores
CVSS v3.1
5.300000190734863
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | java-min | 9.0.0, 12.0.0, 18.0.0 |
Timeline
- May 6, 2026 CVE Published
- May 8, 2026 CVE Updated
References
- http://www.openwall.com/lists/oss-security/2026/03/03/8 url
- https://gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c url
- https://nvd.nist.gov/vuln/detail/CVE-2026-23865 url
- https://sourceforge.net/projects/freetype/files/freetype2/2.14.2/ url
- https://www.facebook.com/security/advisories/cve-2026-23865 url