{"schema_version":"1.7.5","id":"SUSE-SU-2026:20730-1","published":"2026-03-16T13:23:56Z","modified":"2026-03-24T23:10:55.450055Z","related":["CVE-2026-23865"],"upstream":["CVE-2026-23865"],"summary":"Security update for freetype2","details":"This update for freetype2 fixes the following issue:\n\nUpdate to freetype2 2.14.2:\n\n- CVE-2026-23865: Integer overflow in the tt_var_load_item_variation_store function (bsc#1259118).\n\nChangelog:\n\n * Several changes related to LCD filtering are implemented to\n achieve better performance and encourage sound practices.\n * Instead of blanket LCD filtering over the entire bitmap, it\n is now applied only to non-zero spans using direct rendering.\n This speeds up the ClearType-like rendering by more than 40%\n at sizes above 32 ppem.\n * Setting the filter weights with FT_Face_Properties is no\n longer supported. The default and light filters are optimized\n to work with any face.\n * The legacy libXft LCD filter algorithm is no longer provided.\n * The italic angle in `PS_FontInfo` is now stored as a fixed-point\n value in degrees for all Type 1 fonts and their derivatives,\n consistent with CFF fonts and common practices. The broken\n underline position and thickness values are fixed for CFF fonts.\n * The `x` field in the `FT_Span` structure is now unsigned.\n * Demo program `ftgrid` got an option `-m` to select a start\n character to display.\n * Similarly, demo program `ftmulti` got an option `-m` to select a\n text string for rendering.\n * Option `-d` in the demo program `ttdebug` is now called `-a`,\n expecting a comma-separated list of axis values. The user\n interface is also slightly improved.\n * The `ftinspect` demo program can now be compiled with Qt6, too.\n * The auto-hinter got new abilities. It can now better separate\n diacritic glyphs from base glyphs at small sizes by\n artificially moving diacritics up (or down) if necessary\n * Tilde accent glyphs get vertically stretched at small sizes so\n that they don't degenerate to horizontal lines.\n * Diacritics directly attached to a base glyph (like the ogonek in\n character 'ę') no longer distort the shape of the base glyph\n * The TrueType instruction interpreter was optimized to\n produce a 15% gain in the glyph loading speed.\n * Handling of Variation Fonts is now considerably faster\n * TrueType and CFF glyph loading speed has been improved by 5-10%\n on modern 64-bit platforms as a result of better handling of\n fixed-point multiplication.\n * The BDF driver now loads fonts 75% faster.\n","affected":[{"package":{"name":"freetype2","ecosystem":"SUSE:Linux Micro 6.0","purl":"pkg:rpm/suse/freetype2&distro=SUSE%20Linux%20Micro%206.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.2-1.1"}]}],"ecosystem_specific":{"binaries":[{"libfreetype6":"2.14.2-1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:20730-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620730-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1252148"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259118"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-23865"}]}