$ cve CVE-2010-1797 JSON

CVE-2010-1797 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 30.7% (pctl 98)

Patch early

A public exploit exists.

Description

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	30.65% — more likely to be exploited than 98% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2010-08-16
Last modified	2026-06-16

Affected (1)

Vendor	Product
apple	iphone os

Public exploits

Source	Title	Date
exploit-db	Foxit Reader 4.0 - '.pdf' Multiple Stack Based Buffer Overflow 'Jailbreak'	2010-08-24
exploit-db	Apple iOS - '.pdf' Local Privilege Escalation 'Jailbreak'	2010-08-03

References

→ the Explorer · watch your stack · NVD