CVE-2026-15551: Rlottie Freetype Span Truncation Oobcve-2026-15551-rlottie-freetype-span-truncation-oob
A coordinate is capped against `SW_FT_INT_MAX` or `FT_INT_MAX` instead of 32767 before being assigned to a 16-bit short value (like `SW_FT_Span.y`). This leads to integer truncation, potentially resulting in out-of-bounds memory accesses and heap buffer overflows. Cap the coordinate at 32767 instead.
