CVE-2007-2754

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-05-17 · updated 2026-06-16

Description

Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow.

Affected products

FreeType: through 2.3.4

References

http://cvs.savannah.nongnu.org/viewvc/freetype2/src/truetype/ttgload.c?root=freetype&r1=1.177&r2=1.178
http://lists.apple.com/archives/Security-announce/2007/Nov/msg00003.html
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://lists.gnu.org/archive/html/freetype-devel/2007-04/msg00041.html
http://osvdb.org/36509
http://secunia.com/advisories/25350
http://secunia.com/advisories/25353
http://secunia.com/advisories/25386
http://secunia.com/advisories/25463
http://secunia.com/advisories/25483
http://secunia.com/advisories/25609

Get alerted when CVE-2007-2754 or the next vulnerability affects your stack