EvilFontTool

EvilFontTool Una herramienta de engaño basada en fuentes para red teaming, investigación de seguridad y lo que sea. EvilFontTool oculta texto legible por máquina dentro de un documento que muestra un texto completamente distinto a un lector humano. Lo hace mediante Evil Fonts — fuentes que engaña...

confusable-vision

confusable-vision 使用矢量轮廓射线投射进行经验性字形相似度评分。在245种系统字体中渲染Unicode易混淆字符对，直接从字体轮廓（无光栅化）测量结构相似度，并生成带有每个字体连续距离分数的JSON工件。 来自5260万单字符和1.9亿多字符比较的关键结果，涉及22,581个字符和12种书写系统： 249,976个唯一单字符易混淆对 ，跨越245种字体、12种文字、66个跨文字对。总共764,395个字体级发现。 2,524,275个唯一多字符（双字母）易混淆对 ，包括rn/m（95种字体中有33个距离低于0.40）和oy/西里尔uk（16种字体）。 每个字体的连续距离...

z80-sans

Z80 无衬线 你最喜欢的反汇编器是什么？我喜欢的是一个字体： https://github.com/user-attachments/assets/bb6ceb18-c2fd-40a9-be4f-202321a214d9 这个字体通过大量使用 OpenType 的 字形替换表（GSUB） 和 字形定位表（GPOS），将十六进制小写字符序列转换为反汇编后的 Z80 指令。 如果你只是想试试，可以在 ./test/z80-sans.ttf 找到一份副本。 安装 在 Debian GNU/Linux 12 上测试通过。注意，该 Debian 版本自带 ruby 版本 3，而 fontcust...

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-44950

CVE-2026-44950 is a heap buffer overflow in the libXfont2 font-server client (fs_read_glyphs() in src/fc/fserve.c). The function validates each glyph's source slice individually but never checks whether the cumulative destination offset exceeds the allocated buffer size. A malicious font server c...

FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read

A heap out-of-bounds read vulnerability in FreeRDP allows an unauthenticated, malicious RDP server to cause a Denial of Service. By sending a specially crafted glyph fragment update, the server forces the client to read beyond its allocated memory, crashing the application...

FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read

A heap out-of-bounds read vulnerability in FreeRDP allows an unauthenticated, malicious RDP server to cause a Denial of Service. By sending a specially crafted glyph fragment update, the server forces the client to read beyond its allocated memory, crashing the application...

CVE-2026-5281-CVE-2026-11057-fullchain

CVE-2026-5281+CVE-2026-11057 Android fullchain Device Pixel 7 Android 16 ARM64 Chromium version root@kitploit: commit 994c846bbd7a35241ba7c08158c13d66412a6993 HEAD - 146.0.7680.111, tag: 146.0.7680.111 Author: Roger McFarlane Date: Mon Mar 9 12:48:07 2026 -0700 Description Exploitation approach...

FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read

A heap out-of-bounds read vulnerability in FreeRDP allows an unauthenticated, malicious RDP server to cause a Denial of Service. By sending a specially crafted glyph fragment update, the server forces the client to read beyond its allocated memory, crashing the application...

CVE-2025-27363-proof-of-concept

CVE-2025-27363 的概念验证，它会导致 FreeType 2.13.0 崩溃。 此验证修改了 Roboto Flex（一个可变字体），使得 "%" 字符（字形 8）现在变为一个包含 0xfffd 个子字形的复合字形。 使用 FreeType 2.13.0（修复 前的最后一个版本）渲染编辑后的字体会导致崩溃，ASAN 在 loadtruetypeglyph 中检测到堆缓冲区溢出： root@kitploit: $ lldb ../repos2/freetype-demos/build2/ftmulti -- ./rf2.ttf lldb target create...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-106772)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106772 advisory. FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in libfreerdp/cache/glyph.c...

CVE-2026-85458

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

CVE-2026-85458 Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyph

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

CVE-2026-85458

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

EUVD-2026-70735

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read

A heap out-of-bounds read vulnerability in FreeRDP allows an unauthenticated, malicious RDP server to cause a Denial of Service. By sending a specially crafted glyph fragment update, the server forces the client to read beyond its allocated memory, crashing the application...

libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client

A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fsreadglyphs function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the...

libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client

A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fsreadglyphs function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the...

libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client

A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fsreadglyphs function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the...

libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client

A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fsreadglyphs function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the...