CVE-2025-23022
Fixed in a distro release EPSS <1%CVSS 4.0
FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.
Products: freetype
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | freetype | 2.8-14.amzn2.1.4 |
| Amazon Linux 2 | freetype-demos | 2.8-14.amzn2.1.4 |
| Amazon Linux 2 | freetype-devel | 2.8-14.amzn2.1.4 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | freetype2 | 2.6.3-7.24.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | ft2demos | 2.6.3-7.24.1 |