CVE-2026-23865 is an integer overflow vulnerability in the Freetype library that affects Red Hat Hardened Images. The flaw occurs during the processing of specially crafted OpenType variable fonts, leading to an out-of-bounds read condition. A local attacker could exploit this by convincing a user to open a malicious font file, resulting in potential information disclosure or denial of service. The vulnerability requires user interaction and has been rated as moderate impact by Red Hat. Updated RPM packages for freetype (version 2.14.3-1.hum1) have been released to address this issue.

Successful exploitation can cause an out-of-bounds read, which may lead to limited information disclosure or denial of service on affected systems. The attack vector is local with user interaction required, limiting the ease of exploitation. The overall impact is rated as moderate by Red Hat.

Red Hat has released updated RPM packages for freetype (version 2.14.3-1.hum1) for affected architectures (aarch64, x86_64). Users should apply these updates to remediate the vulnerability. No alternative mitigations are specified in the advisory. Patch status is confirmed as available via the updated RPMs.