CVE-2026-50811 is an out-of-bounds read vulnerability in FreeType affecting versions prior to 2.14.3. The flaw is located in the TT_Get_Var_Design function within src/truetype/ttgxvar.c, which is invoked by FT_Get_Var_Design_Coordinates. This vulnerability could cause the application to read memory beyond allocated boundaries, potentially exposing sensitive information or causing a denial of service. No official patch or remediation level has been provided in the available data. There are no known exploits in the wild as of the published date.

The vulnerability allows an attacker to perform an out-of-bounds read, which can lead to limited information disclosure (confidentiality impact) and limited denial of service (availability impact). There is no indication of integrity impact. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates and consider applying any available patches once released.