U.S. CISA adds FreeType flaw to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-27363 | Out-of-Bounds Write in FreeType Font Parsing Allows Arbitrary Code Execution FreeType, the widely bundled open-source font rendering library, contains an out-of-bounds write (CWE-787) when parsing subglyph structures in TrueType GX and variable font files. The flaw is triggered when an application using FreeType renders a specially crafted font file, such as one embedded in a document, webpage, or downloaded file. A successful exploit may allow the attacker to execute arbitrary code with the privileges of the application that processed the font. Because FreeType ships by default with virtually all major Linux distributions, Android, and many applications and embedded products, the affected population is extremely broad, though specific affected version ranges are not enumerated in the available data. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on 2025-05-06, indicating confirmed in-the-wild exploitation, and carries a high EPSS probability of 27.8% (98th percentile); no public proof-of-concept code is known. Do: Update FreeType to the latest available release/commit and apply vendor patches for any product that bundles or depends on it, since exact vulnerable version ranges are not stated in the available data. Inventory your environment for software, operating systems, and dependencies that ship FreeType, and prioritize internet-facing or user-facing systems that process untrusted font files. Federal agencies must follow the CISA KEV required action (apply vendor mitigations per BOD 22-01) or discontinue use if mitigations are unavailable. | 8.1 | 28% | KEV |
| masshundreds of millions to billions of devices (FreeType is the default font-rendering library bundled in major Linux distributions and Android) |
Full article435 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds FreeType flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a FreeType flaw, tracked as CVE-2025-27363 (CVSS score of 8.1), to its Known Exploited Vulnerabilities (KEV) catalog.
In mid-March, Meta warned that the out-of-bounds write vulnerability CVE-2025-27363 may have been actively exploited in attacks.
“An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files.” reads the advisory published by Meta. “The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution.”
The company did not disclose details on the attacks exploiting this vulnerability, attackers, or attack scale.
“This vulnerability may have been exploited in the wild.” continues the advisory.
The vulnerability doesn’t impact FreeType versions after 2.13.0.
The experts warn that multiple Linux distributions are using an outdated library version, making them vulnerable to attacks.
“Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.” concludes the Google’s Bulletin.
This week, Google’s monthly security updates for Android addressed 46 flaws, including the flaw CVE-2025-27363 (CVSS score of 8.1) that has been exploited in the wild. The company did not disclose any details regarding the attacks or the threat actors exploiting the vulnerability.
The vulnerability resides in the System component, and successful exploitation could lead to local code execution.
“The most severe of these issues is a high security vulnerability in the System component that could lead to local code execution with no additional execution privileges needed. User interaction is not needed for exploitation.” reads the Android Security Bulletin—May 2025.
“There are indications that CVE-2025-27363 may be under limited, targeted exploitation.”
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix these vulnerabilities by May 27, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/177537/hacking/u-s-cisa-adds-freetype-flaw-to-its-known-exploited-vulnerabilities-catalog.html