Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2014-9657

21
FAUCET Score

CVE-2014-9657 describes an out-of-bounds read vulnerability in the FreeType library (versions prior to 2.5.4), specifically within the tt_face_load_hdmx function, affecting various Linux distributions and Oracle products. This flaw allows remote attackers to trigger a denial of service or potentially other unspecified impacts by providing a specially crafted TrueType font. With a CVSS score of 7.5, it is considered highly severe, requiring no authentication and having low attack complexity, with potential for partial impact on confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
13.1CPE matchmatch criteria
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
13.2CPE matchmatch criteria
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
6.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
7.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
6.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

7.5HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Exploitability Score
10.0
Impact Score
6.4
CvssVersion
2.0

Exploit Intelligence

EPSS Score
5.06%
Probability of exploitation in next 30 days
EPSS Percentile
91.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0506 is in the 85th percentile among its peer group of 51,506 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: freetype-0:2.3.11-15.el6_6.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: freetype-0:2.4.11-10.el7_1.1
View patch
redhatno patchvia redhat_api
Product: Red Hat Enterprise Virtualization 3Fixed in: mingw-virt-viewer
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 4Fixed in: freetype
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: freetype

Vendor Advisories (1)

redhatCVE-2014-9657Low

freetype: off-by-one buffer over-read in tt_face_load_hdmx()

Nov 24, 2014

References

advisories.mageia.org / MGASA-2015-0083.html
Third Party Advisory
code.google.com / p/google-security-research/issues/detail
Exploit
git.savannah.gnu.org / cgit/freetype/freetype2.git/commit
PatchVendor Advisory
lists.fedoraproject.org / pipermail/package-announce/2015-February/150148.html
Third Party Advisory
lists.fedoraproject.org / pipermail/package-announce/2015-February/150162.html
Third Party Advisory
lists.opensuse.org / opensuse-updates/2015-03/msg00091.html
Third Party Advisory
rhn.redhat.com / errata/RHSA-2015-0696.html
Third Party Advisory
security.gentoo.org / glsa/201503-05
debian.org / security/2015/dsa-3188
Third Party Advisory
mandriva.com / security/advisories
Broken Link
oracle.com / technetwork/topics/security/bulletinapr2015-2511959.html
Third Party Advisory
securityfocus.com / bid/72986
ubuntu.com / usn/USN-2510-1
Third Party Advisory
ubuntu.com / usn/USN-2739-1
Third Party Advisory