An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Telecommunications Update Service Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Via RHSA-2025:3382 https://access.redhat.com/errata/RHSA-2025:3382
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2025:3385 https://access.redhat.com/errata/RHSA-2025:3385
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2025:3384 https://access.redhat.com/errata/RHSA-2025:3384
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2025:3386 https://access.redhat.com/errata/RHSA-2025:3386
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:3383 https://access.redhat.com/errata/RHSA-2025:3383
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2025:3387 https://access.redhat.com/errata/RHSA-2025:3387
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2025:3393 https://access.redhat.com/errata/RHSA-2025:3393
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2025:3395 https://access.redhat.com/errata/RHSA-2025:3395
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:3407 https://access.redhat.com/errata/RHSA-2025:3407
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:3421 https://access.redhat.com/errata/RHSA-2025:3421
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2025:4409 https://access.redhat.com/errata/RHSA-2025:4409
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2025:8195 https://access.redhat.com/errata/RHSA-2025:8195
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2025:8219 https://access.redhat.com/errata/RHSA-2025:8219
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2025:8253 https://access.redhat.com/errata/RHSA-2025:8253
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:8292 https://access.redhat.com/errata/RHSA-2025:8292