FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cffparserrun function in cff/cffparse.c.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-10328.json"