CVE-2026-23865: 
NixOS vulnerability analysis and mitigation

CVE-2026-23865 is an integer overflow vulnerability in the tt_var_load_item_variation_store function of the FreeType font rendering library that may allow an out-of-bounds read when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. It affects FreeType versions 2.13.2, 2.13.3, 2.14.0, and 2.14.1, and was disclosed on March 2, 2026, with a fix released in FreeType 2.14.2 on March 1, 2026. The vulnerability was assigned by Meta as the CNA and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, oss-security). Downstream products including IBM Semeru Runtime, IBM App Connect Enterprise, IBM Sterling Transformation Extender, IBM License Metric Tool, and Microsoft Azure Linux/CBL-Mariner packages are also affected (IBM Advisory, Microsoft MSRC).

The root cause is an integer overflow (CWE-125: Out-of-bounds Read) in the tt_var_load_item_variation_store function within FreeType's TrueType variable font handling code. When parsing HVAR, VVAR, or MVAR tables in OpenType variable fonts, an arithmetic overflow in an internal counter or size calculation can cause the library to read memory beyond the intended buffer boundary. Exploitation requires a user or application to open or process a specially crafted OpenType variable font file, making the attack vector local with required user interaction. The fix is available in the FreeType GitLab repository at commit fc85a255849229c024c8e65f536fe1875d84841c (oss-security, GitLab Commit).

Successful exploitation could result in limited information disclosure (reading out-of-bounds memory contents), minor data integrity impact, or a low-severity availability disruption such as an application crash, all with low individual impact ratings per the CVSS scoring. Because FreeType is widely embedded in operating systems, browsers, Java runtimes, and desktop applications, the attack surface is broad — any application that renders fonts using a vulnerable FreeType version could be affected when processing untrusted font files. Lateral movement potential is low given the local attack vector and requirement for user interaction, but the vulnerability's presence in widely deployed Java runtimes (IBM Semeru) and enterprise software expands organizational exposure (Feedly, IBM Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires local access and user interaction (opening a malicious font file), which significantly limits the practical attack surface.

1. Craft a malicious font file: Create or obtain a specially crafted OpenType variable font file (.otf or .ttf) with a malformed HVAR, VVAR, or MVAR table designed to trigger an integer overflow in the tt_var_load_item_variation_store function.
2. Deliver the font file: Deliver the malicious font file to the target via email attachment, web download, document embedding, or by placing it in a shared directory accessible to the target user.
3. Trigger font processing: Induce the target user or application to open or render the malicious font — for example, by opening a document that embeds the font, visiting a web page that uses it, or previewing it in a file manager that uses FreeType for rendering.
4. Trigger the integer overflow: When FreeType parses the malformed variation store table, the integer overflow occurs in tt_var_load_item_variation_store, causing an out-of-bounds read operation.
5. Achieve objective: Depending on memory layout, the attacker may read adjacent memory contents (information disclosure), cause an application crash (denial of service), or potentially influence application behavior through corrupted data (oss-security, GitLab Commit).

• File System: Presence of unexpected or unknown .otf/.ttf font files in user download directories, temporary folders, or document directories; font files with unusually large or malformed HVAR/VVAR/MVAR table sections.
• Logs: Application crash logs or core dumps from processes that use FreeType (e.g., browsers, document viewers, Java runtimes) referencing tt_var_load_item_variation_store or related TrueType variable font parsing functions.
• Process: Unexpected crashes or abnormal termination of applications that render fonts (e.g., LibreOffice, PDF viewers, web browsers, Java-based applications) shortly after opening a document or font file.
• Network: Unusual downloads of font files from untrusted or unknown external sources in web proxy or firewall logs.

The primary remediation is to upgrade FreeType to version 2.14.2 or later, which contains the fix for this vulnerability (oss-security). Linux distributions including Ubuntu (USN-8086-1, USN-8328-1, USN-8330-1, USN-8341-1), Debian (DSA-6168-1), Red Hat (RHSA-2026:9254, RHSA-2026:9255, RHSA-2026:9693, RHSA-2026:9694, RHSA-2026:9690), SUSE, and OpenSUSE have released updated packages. IBM has issued patches for affected products including Semeru Runtime, App Connect Enterprise, Sterling Transformation Extender, Content Manager Enterprise Edition, and License Metric Tool (IBM Advisory). As a workaround where patching is not immediately possible, restrict users from opening untrusted font files and disable processing of variable OpenType fonts in affected applications where feasible.

The FreeType maintainer Werner LEMBERG announced the 2.14.2 release with the note "A bunch of potential security problems have been found. All users should update," underscoring the urgency of patching (oss-security). The vulnerability was included in Microsoft's March 2026 Patch Tuesday coverage, which received broad media attention from outlets including BleepingComputer and WinBuzzer. The security community noted the wide downstream impact given FreeType's ubiquity in Linux distributions, Java runtimes, and enterprise software stacks. Social media discussion was moderate, with infosec community members on Bluesky and other platforms flagging the patch as a routine but important update.