CVE-2020-15999

CRITICAL KEV

Google Chrome < 86.0.4240.111 - Remote Code Execution via Freetype Heap Buffer Overflow

Title source: llm

Exploitation Summary

CVE-2020-15999 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 3 public exploits from researchers including Marmeus, oxfemale, maarlo.

AI-analyzed exploit summary This repository contains a working PoC for CVE-2020-15999, a heap-buffer-overflow vulnerability in FreeType and Google Chrome. The exploit demonstrates the vulnerability by triggering a crash in both `ftview` (FreeType) and Google Chrome via a maliciously crafted TTF font file.

Description

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Exploits (3)

nomisec WORKING POC 2 stars

by Marmeus · client-side

https://github.com/Marmeus/CVE-2020-15999

View Code ZIP pw:eip

This repository contains a working PoC for CVE-2020-15999, a heap-buffer-overflow vulnerability in FreeType and Google Chrome. The exploit demonstrates the vulnerability by triggering a crash in both `ftview` (FreeType) and Google Chrome via a maliciously crafted TTF font file.

Classification

Working Poc 95%

Attack Type

Dos

Complexity

Moderate

Reliability

Reliable

Target: FreeType (libpng-1.6.37, freetype2-VER-2-10-3), Google Chrome (< 86.0.4240.111)

No auth needed

Prerequisites: Vulnerable version of FreeType or Google Chrome · Ability to execute scripts and install dependencies

MITRE ATT&CK

T1211 - Exploitation for Defense Evasion

devstral-2 · analyzed Feb 16, 2026 Full analysis →

nomisec WORKING POC 2 stars

by oxfemale · poc

https://github.com/oxfemale/CVE-2020-15999

View Code ZIP pw:eip

This repository contains a proof-of-concept exploit for CVE-2020-15999, a heap-buffer-overflow vulnerability in FreeType's handling of SBIX tables in fonts. The exploit demonstrates crashes in both ftview and Chrome, with detailed debugging steps and updates on triggering the vulnerability via JavaScript font loading.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Moderate

Reliability

Reliable

Target: FreeType (via Chrome/Chromium)

No auth needed

Prerequisites: A maliciously crafted font file with an SBIX table · A target application that uses FreeType to render fonts (e.g., Chrome)

MITRE ATT&CK

T1210 - Exploitation of Remote Services

devstral-2 · analyzed Feb 16, 2026 Full analysis →

nomisec WORKING POC 1 stars

by maarlo · poc

https://github.com/maarlo/CVE-2020-15999

View Code ZIP pw:eip

This repository contains a script to exploit CVE-2020-15999, a vulnerability in FreeType. The script sets up the environment, compiles vulnerable versions of libpng and FreeType, and triggers the vulnerability using ftview.

Classification

Working Poc 80%

Attack Type

Dos

Complexity

Moderate

Reliability

Reliable

Target: FreeType 2.10.3

No auth needed

Prerequisites: Linux environment with sudo access · Internet connection to download dependencies

MITRE ATT&CK