JLSEC-2026-460

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-460.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-460.json

JSON Data

https://api.test.osv.dev/v1/vulns/JLSEC-2026-460

Upstream

CVE-2025-27363

EUVD-2025-6367

GHSA-g8qj-jv5h-78cp

Published

2026-05-07T14:50:29.650Z

Modified

2026-05-07T15:17:26.446000877Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:H/MI:H/MA:H CVSS Calculator

Summary

An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font...

Details

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

Database specific

{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "published": "2025-03-11T14:15:25.427Z",
            "imported": "2026-05-07T14:22:19.843Z",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27363",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-27363",
            "modified": "2026-04-20T13:15:39.743Z",
            "id": "CVE-2025-27363",
            "database_specific": {
                "status": "Analyzed"
            }
        },
        {
            "imported": "2026-05-07T14:22:24.124Z",
            "html_url": "https://github.com/advisories/GHSA-g8qj-jv5h-78cp",
            "modified": "2026-04-20T00:30:13Z",
            "url": "https://api.github.com/advisories/GHSA-g8qj-jv5h-78cp",
            "id": "GHSA-g8qj-jv5h-78cp",
            "published": "2025-03-11T15:31:00Z"
        },
        {
            "imported": "2026-05-07T14:22:21.371Z",
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6367",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2025-6367",
            "modified": "2026-04-19T22:08:52Z",
            "id": "EUVD-2025-6367",
            "published": "2025-03-11T13:28:31Z"
        }
    ]
}

References

Affected packages

Julia / FreeType2_jll

Package

Name: FreeType2_jll
Purl: pkg:julia/FreeType2_jll?uuid=d7e528f0-a631-5988-bf34-fe36492bcfd7

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.13.1+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-460.json"