An out‑of‑bounds write occurs when FreeType 2.13.0 and earlier parse font subglyph structures in TrueType GX and variable font files. The code assigns a signed short to an unsigned long, causing a wrap‑around that allocates a buffer too small for the data. Up to six signed long integers are then written beyond the end of the buffer, enabling an attacker to influence control flow and achieve arbitrary code execution. This deficiency is a classic heap overflow (CWE‑787).

The vulnerability impacts the FreeType library, which is bundled with many Linux distributions, including Red Hat Enterprise Linux 8 and 9, Red Hat OpenShift 4.12, and various Red Hat support streams. Any application or service that loads TrueType GX or variable font files via FreeType may be exposed.

With a CVSS score of 8.1 and an EPSS score of 69 %, the risk is high; the vulnerability is listed in the CISA KEV catalog, indicating that exploits have been observed in the wild. Attackers could target any user or process that processes manipulated font files, potentially leading to remote code execution. The likely vector is local or remote input of specially crafted font files to an affected application.