CVE-2009-1194: Pango

Medium severity, CVSS 6.8. EPSS: 4.1% chance of exploitation in the next 30 days.

Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.

Affected products

• Pango Pango: up to and including 1.22; version 1.2 only; version 1.4 only; version 1.6 only; version 1.8 only; version 1.10 only; …

Published 2009-05-11. Last modified 2026-06-16.