CVE-2014-9675: bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring...

Security readout for executives and security teams

CVE-2014-9675 is an information leak in FreeType before 2.5.4. A malicious BDF font could reveal heap pointer values, weakening ASLR protections. The bundle does not show active exploitation or standalone code execution, but FreeType is commonly used wherever fonts are rendered. Exposure is most likely on systems or applications using FreeType before 2.5.4 to parse untrusted BDF fonts. Linux distributions and Android referenced this issue in security advisories, but the bundle does not enumerate all affected packages or embedded copies. Prioritize remediation where font parsing touches external content, uploaded files, email, documents, or web-rendered assets. This is not documented as actively exploited in the bundle, but it weakens a major memory-safety defense and should be closed during normal patch cycles. Mitigation focus: Upgrade FreeType to 2.5.4 or a vendor-patched package.; Apply relevant distribution advisories from Debian, Ubuntu, Red Hat, Gentoo, Fedora, or SUSE.; Restrict processing of untrusted BDF fonts until patched..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.