QSN-8881-1: FreeType vulnerability
2026-10-06

Summary:
FreeType could be made to crash if it opened a specially crafted file.

Details:
It was discovered that FreeType had a flaw in its CID font loader. An
attacker could possibly use this issue to cause FreeType to consume
excessive memory and CPU resources, leading to a denial of service.

Affected QuantaStor releases:
  6.9.1.001 jammy: libfreetype6 2.11.1+dfsg-1ubuntu0.4 (fixed in 2.11.1+dfsg-1ubuntu0.4)
  6.9.0.464 jammy: libfreetype6 2.11.1+dfsg-1ubuntu0.4 (fixed in 2.11.1+dfsg-1ubuntu0.4)
  6.8.6.015 jammy: libfreetype6 2.11.1+dfsg-1ubuntu0.3 (fixed in 2.11.1+dfsg-1ubuntu0.4)
  6.8.5.018 jammy: libfreetype6 2.11.1+dfsg-1ubuntu0.3 (fixed in 2.11.1+dfsg-1ubuntu0.4)
  6.8.4.038 jammy: libfreetype6 2.11.1+dfsg-1ubuntu0.3 (fixed in 2.11.1+dfsg-1ubuntu0.4)
  6.8.3.018 jammy: libfreetype6 2.11.1+dfsg-1ubuntu0.3 (fixed in 2.11.1+dfsg-1ubuntu0.4)
  6.8.2.002 jammy: libfreetype6 2.11.1+dfsg-1ubuntu0.3 (fixed in 2.11.1+dfsg-1ubuntu0.4)
  6.8.1.007 jammy: libfreetype6 2.11.1+dfsg-1ubuntu0.3 (fixed in 2.11.1+dfsg-1ubuntu0.4)
  6.8.0.205 jammy: libfreetype6 2.11.1+dfsg-1ubuntu0.3 (fixed in 2.11.1+dfsg-1ubuntu0.4)

CVEs: CVE-2026-95512

References:
  https://ubuntu.com/security/notices/USN-8881-1