CVE-2015-9290: In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict wher...

Security readout for executives and security teams

FreeType had a flaw before version 2.6.1 where specially handled Type 1 font parsing could read past a buffer. This is a memory-safety issue in a widely embedded font library, so urgency depends on whether your systems process untrusted fonts using affected FreeType builds. Exposure is likely where FreeType before 2.6.1 is packaged or embedded and parses Type 1 fonts. The bundle names FreeType but does not provide specific affected CPEs. Debian LTS and F5 references indicate downstream vendor assessment, not universal exposure. Prioritize as a dependency hygiene and exposure-management item. It is old and lacks public severity scoring in the provided bundle, but FreeType is commonly embedded. Patch affected assets through normal vulnerability remediation unless a vendor flags higher urgency for your environment. Mitigation focus: Upgrade FreeType to 2.6.1 or later where directly managed.; Apply downstream vendor security updates for systems bundling FreeType.; Review Debian LTS guidance for affected Debian package versions..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.