diff --git a/vcl/source/fontsubset/cff.cxx b/vcl/source/fontsubset/cff.cxx
index bbcb5176dbf8d..d1c332634b5fd 100644
--- a/vcl/source/fontsubset/cff.cxx
+++ b/vcl/source/fontsubset/cff.cxx
@@ -1337,7 +1337,8 @@ class CffContext : private CffGlobal
 private:
     bool convertCharStrings(std::vector<CharString>& rCharStrings, int nGlyphCount,
                             const sal_GlyphId* pGlyphIds = nullptr);
-    int convert2Type1Ops(CffLocal*, const U8* pType2Ops, int nType2Len, U8* pType1Ops);
+    int convert2Type1Ops(CffLocal*, const U8* pType2Ops, int nType2Len, U8* pType1Ops,
+                         size_t nType1Cap);
     bool convertOneTypeOp();
     bool convertOneTypeEsc();
     bool callType2Subr(bool bGlobal, int nSubrNumber);
@@ -1348,6 +1349,11 @@ class CffContext : private CffGlobal
     // != mpReadEnd post-check so flags as a parse failure.
     void abandonDictParse() { mpReadPtr = mpReadEnd + 1; }
 
+    // Abandon the charstring conversion when the output buffer is full.
+    // callType2Subr does not restore mpWritePtr, so this stays in effect when
+    // the buffer fills inside a subroutine.
+    void abandonConversion() { mpWritePtr = mpWriteEnd + 1; }
+
     const U8* mpBasePtr;
     const U8* mpBaseEnd;
 
@@ -1355,6 +1361,8 @@ class CffContext : private CffGlobal
     const U8* mpReadEnd;
 
     U8* mpWritePtr;
+    U8* mpWriteEnd;
+    int mnSubrDepth;
     bool mbNeedClose;
     bool mbIgnoreHints;
     sal_Int32 mnCntrMask;
@@ -1374,6 +1382,9 @@ class CffContext : private CffGlobal
     bool getBaseAccent(ValType aBase, ValType aAccent, int* nBase, int* nAccent);
 
     void read2push();
+    // True if nBytes more fit in the output buffer; otherwise abandon the
+    // conversion and return false so the caller skips the write.
+    bool hasWriteRoom(int nBytes);
     void writeType1Val(ValType);
     void writeTypeOp(int nTypeOp);
     void writeTypeEsc(int nTypeOp);
@@ -1420,6 +1431,8 @@ CffContext::CffContext(const U8* pBasePtr, int nBaseLen)
     , mpReadPtr(nullptr)
     , mpReadEnd(nullptr)
     , mpWritePtr(nullptr)
+    , mpWriteEnd(nullptr)
+    , mnSubrDepth(0)
     , mbNeedClose(false)
     , mbIgnoreHints(false)
     , mnCntrMask(0)
@@ -1755,8 +1768,21 @@ void CffContext::read2push()
     push(aVal);
 }
 
+bool CffContext::hasWriteRoom(int nBytes)
+{
+    if (mpWritePtr + nBytes <= mpWriteEnd)
+        return true;
+    abandonConversion();
+    return false;
+}
+
 void CffContext::writeType1Val(ValType aVal)
 {
+    // Five bytes for the number, plus five more and a two byte "div" escape
+    // when a fractional value is split.
+    if (!hasWriteRoom(12))
+        return;
+
     U8* pOut = mpWritePtr;
 
     // tdf#126242
@@ -1815,10 +1841,17 @@ void CffContext::writeType1Val(ValType aVal)
     }
 }
 
-inline void CffContext::writeTypeOp(int nTypeOp) { *(mpWritePtr++) = static_cast<U8>(nTypeOp); }
+inline void CffContext::writeTypeOp(int nTypeOp)
+{
+    if (!hasWriteRoom(1))
+        return;
+    *(mpWritePtr++) = static_cast<U8>(nTypeOp);
+}
 
 inline void CffContext::writeTypeEsc(int nTypeEsc)
 {
+    if (!hasWriteRoom(2))
+        return;
     *(mpWritePtr++) = TYPE1OP::T1ESC;
     *(mpWritePtr++) = static_cast<U8>(nTypeEsc);
 }
@@ -2370,28 +2403,40 @@ bool CffContext::callType2Subr(bool bGlobal, int nSubrNumber)
             return false;
     }
 
-    while (mpReadPtr < mpReadEnd)
+    // The CFF specification limits subroutine call nesting to 10 levels;
+    // deeper nesting would let cyclic subroutines recurse without bound.
+    if (mnSubrDepth >= 10)
+        return false;
+    ++mnSubrDepth;
+
+    bool bRet = true;
+    while (mpReadPtr < mpReadEnd && mpWritePtr <= mpWriteEnd)
     {
         if (!convertOneTypeOp())
-            return false;
+        {
+            bRet = false;
+            break;
+        }
     }
+    --mnSubrDepth;
 
     mpReadPtr = pOldReadPtr;
     mpReadEnd = pOldReadEnd;
-    return true;
+    return bRet;
 }
 
 int CffContext::convert2Type1Ops(CffLocal* pCffLocal, const U8* const pT2Ops, int nT2Len,
-                                 U8* const pT1Ops)
+                                 U8* const pT1Ops, size_t nT1Cap)
 {
     mpCffLocal = pCffLocal;
 
     // prepare the charstring conversion
     mpWritePtr = pT1Ops;
-    U8 aType1Ops[MAX_T1OPS_SIZE];
-    if (!pT1Ops)
-        mpWritePtr = aType1Ops;
-    *const_cast<U8**>(&pT1Ops) = mpWritePtr;
+
+    // Remember where the output buffer ends so the write primitives can tell
+    // how much space is left. Start with no subroutine nesting.
+    mpWriteEnd = mpWritePtr + nT1Cap;
+    mnSubrDepth = 0;
 
     // prepend random seed for T1crypt
     *(mpWritePtr++) = 0x48;
@@ -2419,11 +2464,13 @@ int CffContext::convert2Type1Ops(CffLocal* pCffLocal, const U8* const pT2Ops, in
     mnHintSize = mnHorzHintSize = mnStackIdx = 0;
     maCharWidth = -1; //#######
     mnCntrMask = 0;
-    while (mpReadPtr < mpReadEnd)
+    while (mpReadPtr < mpReadEnd && mpWritePtr <= mpWriteEnd)
     {
         if (!convertOneTypeOp())
             return -1;
     }
+    if (mpWritePtr > mpWriteEnd)
+        return -1;
     if (maCharWidth != -1)
     {
         // overwrite earlier charWidth value, which we only now have
@@ -3168,7 +3215,8 @@ bool CffContext::convertCharStrings(std::vector<CharString>& rCharStrings, int n
             return false;
 
         CharString aCharString;
-        const int nT1Len = convert2Type1Ops(mpCffLocal, mpReadPtr, nT2Len, aCharString.aOps);
+        const int nT1Len = convert2Type1Ops(mpCffLocal, mpReadPtr, nT2Len, aCharString.aOps,
+                                            std::size(aCharString.aOps));
         if (nT1Len < 0)
             return false;
         aCharString.nLen = nT1Len;