Google Chrome FreeType Heap Buffer Overflow Vulnerability
Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.
- Vendor
- Product
- Chrome FreeType
- CVSS
- 9.6
- EPSS (exploit probability)
- 44.3%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.
Added to CISA’s Known Exploited Vulnerabilities catalog on 2021-11-03. Required action per CISA: Apply updates per vendor instructions. Due date: 2021-11-17.
This is an auto-synced KEV catalog record pending a full 0dayNews write-up — see CISA’s KEV catalog and the NVD record linked above for primary sources.