← Vulnerability feed

Vulnerability record · CVE-2010-0421 · published 18 March 2010

CVE-2010-0421: Gnome pango memory buffer overflow vulnerability

Gnome · Pango

Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted font file, related to building a synthetic Glyph Definition (aka GDEF) table by using this font's charmap and the Unicode property database.

4.3 CVSS 2.0 Medium EPSS 2.5% · top 16.1% CWE-119 · Memory buffer overflow
4.3CVSS 2.0 base score
2.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
30References
16 Jun 2026Last modified by NVD

Description

Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted font file, related to building a synthetic Glyph Definition (aka GDEF) table by using this font's charmap and the Unicode property database.

AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://ftp.gnome.org/pub/GNOME/sources/pango/1.27/pango-1.27.1.tar.bz2 Patch
http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
http://secunia.com/advisories/39041
http://securitytracker.com/id?1023711
http://www.debian.org/security/2010/dsa-2019
http://www.mandriva.com/security/advisories?name=MDVSA-2010:121
http://www.redhat.com/support/errata/RHSA-2010-0140.html
http://www.securityfocus.com/bid/38760
http://www.vupen.com/english/advisories/2010/0627
http://www.vupen.com/english/advisories/2010/0661
http://www.vupen.com/english/advisories/2010/1552
https://bugzilla.redhat.com/show_bug.cgi?id=555831
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9417
http://ftp.gnome.org/pub/GNOME/sources/pango/1.27/pango-1.27.1.tar.bz2 Patch
http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
http://secunia.com/advisories/39041
http://securitytracker.com/id?1023711
http://www.debian.org/security/2010/dsa-2019
http://www.mandriva.com/security/advisories?name=MDVSA-2010:121
http://www.redhat.com/support/errata/RHSA-2010-0140.html
http://www.securityfocus.com/bid/38760
http://www.vupen.com/english/advisories/2010/0627
http://www.vupen.com/english/advisories/2010/0661
http://www.vupen.com/english/advisories/2010/1552
https://bugzilla.redhat.com/show_bug.cgi?id=555831
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9417

Track CVE-2010-0421 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-1010238Gnome pango out-of-bounds write vulnerabilityGnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The comp…EPSS 6.3%9.3CVE-2011-3193Gnome pango out-of-bounds write vulnerabilityHeap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows …EPSS 7.3%7.6CVE-2011-0020Gnome pango memory buffer overflow vulnerabilityHeap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when t…EPSS 19%6.8CVE-2011-0064Gnome pango vulnerabilityThe hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocat…EPSS 3.3%6.5CVE-2018-15120Gnome pango memory buffer overflow vulnerabilitylibpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application cra…EPSS 11%9.5CVE-2026-88772Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 F…KEV8.8CVE-2026-8452Citrix NetScaler ADC and Gateway memory buffer overflow causes DoSCVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that leads to unpredictable or erroneous behavior a…KEVEPSS 1.0%analysed8.8CVE-2009-3459Adobe Reader and Acrobat heap buffer overflow via crafted PDFAdobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 contain a heap-based buffer overflow (CWE-122) triggered by a crafted…KEVEPSS 87%analysed

Source: NIST National Vulnerability Database (record CVE-2010-0421), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.