Unrated severityNVD Advisory· Published Mar 18, 2014· Updated May 6, 2026

CVE-2014-2241

Description

The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.

Affected products

FreeType/Freetype3 versions
cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*range: <=2.5.2
- cpe:2.3:a:freetype:freetype:2.5:*:*:*:*:*:*:*
- cpe:2.3:a:freetype:freetype:2.5.1:*:*:*:*:*:*:*
Canonical/Ubuntu Linux
cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
osv-coords2 versions
pkg:rpm/opensuse/freetype2&distro=openSUSE%20Tumbleweed pkg:rpm/suse/freetype2&distro=SUSE%20Linux%20Micro%206.0
< 2.7-1.1+ 1 more
- (no CPE)range: < 2.7-1.1
- (no CPE)range: < 2.13.3-1.1

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000