The vulnerability is an out‑of‑bounds read in the TT_Get_Var_Design function of the FreeType 2.14.3 font rendering library. When an application processes a TrueType variable font using FT_Get_Var_Design_Coordinates, the library reads beyond the bounds of an internal table, potentially revealing arbitrary data from the process’s memory. This flaw is a classic CWE‑125 error and results in a data disclosure that does not provide code execution or privilege escalation.

Any installation running FreeType 2.14.3 or earlier that contains the code before commit 5a280ecde6f324de0d226261036e736e0cb49a71 is affected. Common consumers of this library include desktop operating systems, web browsers, graphics editors, terminal emulators, and embedded devices that depend on FreeType for font rendering.

The CVSS score of 6.5 indicates a medium severity data confidentiality impact. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is the delivery of a crafted variable‑font file to an application that uses FreeType, such as via a user‑supplied document or a malicious software update that includes a font. Successful exploitation would allow an attacker to read unintended process memory but would not provide persistence, privilege escalation, or remote code execution.