CVE-2026-95512
Received Received - Intake

Memory Exhaustion in FreeType CID Font Loader

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: redhat-SADP

Description
A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-95512
EUVD
EUVD-2026-91327

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
freetype freetype 2.13.2-8.el10
freetype freetype *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-95512 is a denial-of-service vulnerability in FreeType's CID font loader. It occurs when a specially crafted CID-keyed font causes repeated allocations and decryptions of subroutine data across multiple font dictionaries during face loading. This leads to excessive memory and CPU consumption, potentially causing the application or service processing the font to hang or terminate.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal memory and CPU usage when processing CID-keyed fonts. Check for applications using FreeType that hang or crash when loading fonts. Use system monitoring tools like 'top', 'htop', or 'ps' to observe resource consumption spikes during font rendering tasks.

Impact Analysis

This vulnerability can impact you by disrupting services that process fonts. If an attacker tricks you into opening content with a malicious CID-keyed font, it may consume excessive system resources, causing applications to slow down, freeze, or crash. This could affect productivity and system availability.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions through resource exhaustion, which may disrupt services handling sensitive data. While it does not directly violate GDPR or HIPAA, prolonged service unavailability could impact data processing operations subject to these regulations, potentially leading to compliance issues if critical systems are affected.

Mitigation Strategies

Immediately avoid parsing untrusted CID fonts. Isolate font handling in separate processes to limit impact. Update FreeType to a patched version if available. Reject or filter CID fonts before they reach FreeType to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95512. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart