Logo
›
›vulnerability›CVE-2025-27363
Name
CVE-2025-27363
Source
NVD ( link)Debian ( link)
Description
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
CWEs
CWE-787
Published Date
Updated Date
Workaround
-
Advisories
https://www.facebook.com/security/advisories/cve-2025-27363Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/03/13/1Mailing List
http://www.openwall.com/lists/oss-security/2025/03/13/11Mailing List
http://www.openwall.com/lists/oss-security/2025/03/13/12Mailing List
http://www.openwall.com/lists/oss-security/2025/03/13/2Mailing List
http://www.openwall.com/lists/oss-security/2025/03/13/3Mailing List
http://www.openwall.com/lists/oss-security/2025/03/13/8Mailing List
http://www.openwall.com/lists/oss-security/2025/03/14/1Mailing List
http://www.openwall.com/lists/oss-security/2025/03/14/2Mailing List
http://www.openwall.com/lists/oss-security/2025/03/14/3Mailing List
http://www.openwall.com/lists/oss-security/2025/03/14/4Mailing List
http://www.openwall.com/lists/oss-security/2025/05/06/3Mailing List
http://www.openwall.com/lists/oss-security/2026/04/16/5Mailing List
http://www.openwall.com/lists/oss-security/2026/04/19/3Mailing List
https://lists.debian.org/debian-lts-announce/2025/03/msg00030.htmlMailing List
https://source.android.com/docs/security/bulletin/2025-05-01Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27363US Government Resource

Analysis#

Affected Component
Analysis
freetype
Patched

Vulnerability Ratings#

8.1
CVSSv31
8.1
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
freetype
buildroot
2025.02.x
2.13.3
Not Affected
freetype
buildroot
master
2.14.3
Not Affected
freetype
openwrt
master
2.13.3-r2
Not Affected
freetype
openwrt
openwrt-25.12
2.13.3-r1
Not Affected
freetype
yocto
master
2.14.3
Not Affected
freetype
yocto
scarthgap
2.13.2
Patched

Resolved with patches#

freetype (yocto:kirkstone)

#
Title
Author
Resolve
1
fix OOB write when when attempting to parse font subglyph
Marc Deslauriers <marc.deslauriers@ubuntu.com>
CVE-2025-27363

freetype (yocto:scarthgap)

#
Title
Author
Resolve
1
* src/truetype/ttgload.c (load_truetype_glyph): Unsigned fix.
Alexei Podtelezhnikov <apodtele@gmail.com>
CVE-2025-27363