Meta warns of actively exploited flaw in FreeType library

FreeType, the widely bundled open-source font rendering library, contains an out-of-bounds write (CWE-787) when parsing subglyph structures in TrueType GX and variable font files. The flaw is triggered when an application using FreeType renders a specially crafted font file, such as one embedded in a document, webpage, or downloaded file. A successful exploit may allow the attacker to execute arbitrary code with the privileges of the application that processed the font. Because FreeType ships by default with virtually all major Linux distributions, Android, and many applications and embedded products, the affected population is extremely broad, though specific affected version ranges are not enumerated in the available data. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on 2025-05-06, indicating confirmed in-the-wild exploitation, and carries a high EPSS probability of 27.8% (98th percentile); no public proof-of-concept code is known.

Do: Update FreeType to the latest available release/commit and apply vendor patches for any product that bundles or depends on it, since exact vulnerable version ranges are not stated in the available data. Inventory your environment for software, operating systems, and dependencies that ship FreeType, and prioritize internet-facing or user-facing systems that process untrusted font files. Federal agencies must follow the CISA KEV required action (apply vendor mitigations per BOD 22-01) or discontinue use if mitigations are unavailable.