Pango is a text-rendering library embedded across a range of applications including VPN software and related network tooling, where its attack surface centers on file handling and memory access in typography processing. The observed weakness classes include improper link resolution, buffer boundary violations, permission assignment flaws, and unrestricted file uploads—attack patterns typical of complex input-handling components that mediate between untrusted font data and system resources. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pango over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2011-0020HIGH Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled | Jan 24, 2011 | 7.6 | 44 | NO | YES |
CVE-2020-12828CRITICAL An issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain executable locations over a socket bound to localhost. Binding to the socket and p | May 21, 2020 | 9.8 | 27 | NO | NO |
CVE-2009-1194MEDIUM Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (applicatio | May 11, 2009 | 6.8 | 25 | NO | NO |
CVE-2020-17365HIGH Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to potentially enable escalation of privilege v | Sep 24, 2020 | 7.8 | 21 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pango.
Media articles that mention a CVE ID that affects a product developed by Pango — matched by CVE ID, not by vendor name.