A heap buffer overflow vulnerability exists in the FreeType library's TrueType bytecode interpreter. The vulnerability is triggered by the SHZ (Shift Zone) instruction when executed within a composite glyph context. Improper calculation of the loop limit leads to an out-of-bounds memory access (both read and write) in the Move_Zp2_Point function. An attacker can leverage this to cause an application crash or potentially achieve arbitrary code execution.
| Vendor | Product | Versions |
|---|---|---|
| freetype-project.org | — | — |
