PT-2020-1256 · Freetype+9 · Freetype+9
Published
2020-10-19
·
Updated
2026-05-07
·
CVE-2020-15999
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 86.0.4240.111
Description
The issue is related to a heap buffer overflow in the FreeType library used by Google Chrome, which could lead to remote code execution with no additional execution privileges needed. User interaction is required for exploitation. The vulnerability is caused by a heap buffer overflow when processing glyphs with very large bitmaps. There are reports that this issue is being actively exploited by attackers.
Recommendations
For Google Chrome versions prior to 86.0.4240.111, update to version 86.0.4240.111 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted HTML pages or TTF fonts with PNG sbit glyphs until the update is applied. Restrict access to the FreeType library to minimize the risk of exploitation.
Exploit
Fix
Memory Corruption
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Freetype
Google Chrome
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu