CVE-2011-0020

CVE-2011-0020 describes a heap-based buffer overflow in the pango_ft2_font_render_box_glyph function within Pango versions 1.28.3 and earlier, specifically when the FreeType2 backend is enabled. This flaw allows user-assisted remote attackers to trigger a denial of service or potentially execute arbitrary code through a specially crafted font file. The vulnerability carries a CVSS score of 7.6, indicating high severity due to its network-based attack vector, high impact on confidentiality, integrity, and availability, though it requires high attack complexity. While not listed on CISA's KEV catalog or the Hot List, an exploit (EDB-35232) for heap corruption exists on ExploitDB, but there is no evidence of active exploitation, Metasploit modules, or significant community discussion.