PT-2026-38075 · Bitnami · Java-Min

Published 2026-05-06 · Updated 2026-05-06

OSV

An integer overflow in the tt var load item variation store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.

Related Identifiers

BIT-JAVA-MIN-2026-23865

Affected Products

Java-Min

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-23865 · Security Note
• https://osv.dev/vulnerability/BIT-java-min-2026-23865 · Vendor Advisory
• https://gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c · Note
• https://facebook.com/security/advisories/cve-2026-23865 · Note
• https://sourceforge.net/projects/freetype/files/freetype2/2.14.2 · Note
• http://openwall.com/lists/oss-security/2026/03/03/8 · Note