CVE-2021-28030: Truetype Project Truetype

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.

Affected products

• Truetype Project Truetype: before 0.30.1 (fixed in 0.30.1)

Published 2021-03-05. Last modified 2026-06-17.