Vulnerability record · CVE-2025-27363 · published 11 March 2025
CVE-2025-27363: FreeType out-of-bounds write in TrueType GX and variable font parsing
Freetype · Freetype
FreeType 2.13.0 and earlier mishandle font subglyph structures in TrueType GX and variable font files: a signed short is assigned to an unsigned long, a static value is added, the result wraps, and too small a heap buffer is allocated. The code then writes up to 6 signed long integers out of bounds, which may allow arbitrary code execution. The record states the issue may have been exploited in the wild, and CISA added it to KEV.
Description
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityThe flaw is a remotely reachable out-of-bounds write that may enable code execution, is listed in CISA KEV with a past due date, and has a high EPSS score, though exploitation requires a crafted font and high attack complexity.
What it is
FreeType 2.13.0 and earlier mishandle font subglyph structures in TrueType GX and variable font files: a signed short is assigned to an unsigned long, a static value is added, the result wraps, and too small a heap buffer is allocated. The code then writes up to 6 signed long integers out of bounds, which may allow arbitrary code execution. The record states the issue may have been exploited in the wild, and CISA added it to KEV.
Impact
An attacker can corrupt heap memory and potentially achieve arbitrary code execution in the context of the process parsing the font. Because FreeType is embedded in many rendering stacks, the affected process may be a browser, document viewer, or system service.
Attack surface
Reached remotely over the network with no privileges and no user interaction per the CVSS vector (AV:N/PR:N/UI:N), by supplying a crafted TrueType GX or variable font file to any component that parses fonts with the vulnerable FreeType. The high attack complexity (AC:H) reflects the specific subglyph structure needed to trigger the wrap and out-of-bounds write.
Exploitation
CISA added this to KEV on 2025-05-06 with a remediation due date of 2025-05-27, and the description states it may have been exploited in the wild. EPSS gives a 30-day probability of 0.27775 (97.99th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Upgrade FreeType to a version newer than 2.13.0, which the record states is not vulnerable.
- Apply vendor patches for all products that bundle FreeType, including Debian and Android, per their advisories.
- If patching is not immediately possible, restrict or disable processing of untrusted TrueType GX and variable font files in affected applications.
- Follow CISA BOD 22-01 guidance for cloud services and discontinue use of unpatchable products as directed in the KEV entry.
- Inventory embedded FreeType copies in browsers, document viewers, and other rendering components, since these are often updated separately from the OS package.
Detection
- Monitor for crashes or memory corruption in processes that parse fonts, especially when handling TrueType GX or variable font files.
- Hunt for delivery of font files from untrusted sources to applications that use FreeType, and inspect font parsing activity in browser and document viewer telemetry.
- Check endpoint and server inventories for FreeType versions 2.13.0 and below, and for unpatched Debian or Android builds covered by vendor advisories.
- Alert on exploitation indicators referenced in the CISA KEV entry and related vendor advisories.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2025-27363 to the Known Exploited Vulnerabilities catalog on 6 May 2025 as "FreeType Out-of-Bounds Write Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 27 May 2025.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2025-27363 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-27363), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
