FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1decoderparse_charstrings function in psaux/t1decode.c.
{ "urgency": "not yet assigned" }