Critical
Security advisory
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-15999
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:12 UTC · Revision 1
Source evidence
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
osv:CVE-2020-15999
Complete source record
{
"id": "001edb42b5225eb3aeb3ff15e1ab9809471757558688da5936d2c2bccc7ac6eb",
"url": "https://osv.dev/vulnerability/CVE-2020-15999",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-15999",
"summary": "Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
"evidence": "osv:CVE-2020-15999",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2020-15999",
"aliases": [
"A-171232105",
"ASB-A-171232105",
"CVE-2020-15999",
"GHSA-pv36-h7jh-qm62"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/freetype/freetype",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "6a2b3e4007e794bfc6c91030d0ed987f925164a8"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.10.4"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"VER-2-10-3",
"VER-2-10-2",
"VER-2-10-1",
"VER-2-10-0",
"VER-2-9-1",
"VER-2-9",
"VER-2-8-1",
"VER-2-8",
"VER-2-7-1",
"VER-2-7",
"VER-2-6-4",
"VER-2-6-3",
"VER-2-6-2",
"VER-2-6-1",
"VER-2-6",
"VER-2-5-5",
"VER-2-5-4",
"VER-2-5-3",
"VER-2-5-2",
"VER-2-5-1",
"VER-2-5-0-1",
"VER-2-5-0",
"VER-2-4-12",
"VER-2-4-12-beta",
"VER-2-4-11",
"VER-2-4-10",
"VER-2-4-9",
"VER-2-4-8",
"VER-2-4-7",
"VER-2-4-6",
"VER-2-4-5",
"VER-2-4-4",
"VER-2-4-3",
"VER-2-4-2",
"VER-2-4-1",
"VER-2-4-0",
"VER-2-3-12",
"VER-2-3-11",
"VER-2-3-10",
"VER-2-3-9",
"VER-2-3-8",
"VER-2-3-7",
"VER-2-3-6",
"VER-2-3-5-REAL",
"VER-2-3-5",
"VER-2-3-4",
"VER-2-3-3",
"VER-2-3-2",
"VER-2-3-1-FINAL",
"VER-2-3-1",
"VER-2-3-0-FINAL",
"VER-2-3-0-RC2",
"VER-2-3-0",
"VER-2-3-0-RC1",
"VER-2-2-1",
"VER-2-2-0-RC4",
"VER-2-2-0",
"VER-2-2-0-RC3",
"VER-2-2-0-RC2",
"VER-2-2-0-RC1",
"DATE-050920",
"VER-2-1-10",
"VER-2-1-9",
"VER-2-1-8",
"VER-2-1-8-RC1",
"import",
"VER-2-1-7",
"VER-2-1-6",
"VER-2-1-5-RC1",
"start",
"VER-2-1-4",
"VER-2-1-4-RC2",
"VER-2-1-4-RC1",
"VER-2-1-3",
"VER-2-1-3-RC3",
"VER-2-1-3-RC2",
"VER-2-1-3-RC1",
"VER-2-1-2",
"VER-2-1-2-RC1",
"VER-2-1-1",
"VER-2-1-1-RC1",
"freetype",
"VER-2-1-0",
"VER-2-0-8",
"VER-2-0-7",
"VER-2-0-6",
"PRE-2-0-6",
"VER-2-0-5",
"freetype2",
"VER-2-0-4",
"VER-2-0-3",
"VER-2-0-2",
"VER-2-0-2-TEST",
"VER-2-0-1",
"PRE-2-0-1",
"VER-2-0",
"RELEASE-2-0",
"BETA-8",
"BETA-7",
"BETA-6",
"BETA-5",
"VER-2-BETA4",
"VER-2-BETA3",
"VER-2-BETA2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15999.json"
}
},
{
"ranges": [
{
"repo": "https://gitlab.freedesktop.org/freetype/freetype",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "6a2b3e4007e794bfc6c91030d0ed987f925164a8"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.10.4"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"VER-2-10-3",
"VER-2-10-2",
"VER-2-10-1",
"VER-2-10-0",
"VER-2-9-1",
"VER-2-9",
"VER-2-8-1",
"VER-2-8",
"VER-2-7-1",
"VER-2-7",
"VER-2-6-4",
"VER-2-6-3",
"VER-2-6-2",
"VER-2-6-1",
"VER-2-6",
"VER-2-5-5",
"VER-2-5-4",
"VER-2-5-3",
"VER-2-5-2",
"VER-2-5-1",
"VER-2-5-0-1",
"VER-2-5-0",
"VER-2-4-12",
"VER-2-4-12-beta",
"VER-2-4-11",
"VER-2-4-10",
"VER-2-4-9",
"VER-2-4-8",
"VER-2-4-7",
"VER-2-4-6",
"VER-2-4-5",
"VER-2-4-4",
"VER-2-4-3",
"VER-2-4-2",
"VER-2-4-1",
"VER-2-4-0",
"VER-2-3-12",
"VER-2-3-11",
"VER-2-3-10",
"VER-2-3-9",
"VER-2-3-8",
"VER-2-3-7",
"VER-2-3-6",
"VER-2-3-5-REAL",
"VER-2-3-5",
"VER-2-3-4",
"VER-2-3-3",
"VER-2-3-2",
"VER-2-3-1-FINAL",
"VER-2-3-1",
"VER-2-3-0-FINAL",
"VER-2-3-0-RC2",
"VER-2-3-0",
"VER-2-3-0-RC1",
"VER-2-2-1",
"VER-2-2-0-RC4",
"VER-2-2-0",
"VER-2-2-0-RC3",
"VER-2-2-0-RC2",
"VER-2-2-0-RC1",
"DATE-050920",
"VER-2-1-10",
"VER-2-1-9",
"VER-2-1-8",
"VER-2-1-8-RC1",
"import",
"VER-2-1-7",
"VER-2-1-6",
"VER-2-1-5-RC1",
"start",
"VER-2-1-4",
"VER-2-1-4-RC2",
"VER-2-1-4-RC1",
"VER-2-1-3",
"VER-2-1-3-RC3",
"VER-2-1-3-RC2",
"VER-2-1-3-RC1",
"VER-2-1-2",
"VER-2-1-2-RC1",
"VER-2-1-1",
"VER-2-1-1-RC1",
"freetype",
"VER-2-1-0",
"VER-2-0-8",
"VER-2-0-7",
"VER-2-0-6",
"PRE-2-0-6",
"VER-2-0-5",
"freetype2",
"VER-2-0-4",
"VER-2-0-3",
"VER-2-0-2",
"VER-2-0-2-TEST",
"VER-2-0-1",
"PRE-2-0-1",
"VER-2-0",
"RELEASE-2-0",
"BETA-8",
"BETA-7",
"BETA-6",
"BETA-5",
"VER-2-BETA4",
"VER-2-BETA3",
"VER-2-BETA2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15999.json"
}
}
],
"modified": "2026-10-24T10:30:15.104798405Z",
"provider": "osv",
"references": [
"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15999",
"https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7/",
"https://security.gentoo.org/glsa/202011-12",
"https://security.gentoo.org/glsa/202012-04",
"https://security.gentoo.org/glsa/202401-19",
"https://security.netapp.com/advisory/ntap-20240812-0001/",
"https://www.debian.org/security/2021/dsa-4824",
"https://crbug.com/1139963",
"https://googleprojectzero.blogspot.com/p/rca-cve-2020-15999.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*"
],
"vendor_product": "freetype:freetype",
"extracted_events": [
{
"range": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.10.4"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*"
],
"vendor_product": "google:chrome",
"extracted_events": [
{
"range": [
{
"fixed": "86.0.4240.111"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "31"
},
{
"last_affected": "31"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*"
],
"vendor_product": "opensuse:backports_sle",
"extracted_events": [
{
"range": [
{
"introduced": "15.0-sp2"
},
{
"last_affected": "15.0-sp2"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-15999",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 429101,
"published_at": "2020-11-03T03:15:14.853+00:00"
}