Integer overflow in FreeType - CVE-2025-23022

Vulnerability identifier: #VU108929

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-23022

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to integer overflow within the cf2_doFlex() function in cff/cf2intrp.c. A remote attacker can pass specially crafted image to the application, trigger an integer overflow and perform a denial of service (DoS) attack.

FreeType
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
freetype2-devel
libfreetype6-32bit
libfreetype6-debuginfo
freetype2-debugsource
libfreetype6-debuginfo-32bit
libfreetype6
ft2demos

Install updates from vendor's website.

FreeType - update to 2.9
freetype2-devel - update to 2.6.3-7.24.1
libfreetype6-32bit - update to 2.6.3-7.24.1
libfreetype6-debuginfo - update to 2.6.3-7.24.1
freetype2-debugsource - update to 2.6.3-7.24.1
libfreetype6-debuginfo-32bit - update to 2.6.3-7.24.1
libfreetype6 - update to 2.6.3-7.24.1
ft2demos - update to 2.6.3-7.24.1

• https://gitlab.freedesktop.org/freetype/freetype/-/issues/1312

• Denial of service in FreeType
• SUSE update for freetype2