Update ASAP: Google Fixes Android Flaw (CVE-2025
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-27363 | Out-of-Bounds Write in FreeType Font Parsing Allows Arbitrary Code Execution FreeType, the widely bundled open-source font rendering library, contains an out-of-bounds write (CWE-787) when parsing subglyph structures in TrueType GX and variable font files. The flaw is triggered when an application using FreeType renders a specially crafted font file, such as one embedded in a document, webpage, or downloaded file. A successful exploit may allow the attacker to execute arbitrary code with the privileges of the application that processed the font. Because FreeType ships by default with virtually all major Linux distributions, Android, and many applications and embedded products, the affected population is extremely broad, though specific affected version ranges are not enumerated in the available data. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on 2025-05-06, indicating confirmed in-the-wild exploitation, and carries a high EPSS probability of 27.8% (98th percentile); no public proof-of-concept code is known. Do: Update FreeType to the latest available release/commit and apply vendor patches for any product that bundles or depends on it, since exact vulnerable version ranges are not stated in the available data. Inventory your environment for software, operating systems, and dependencies that ship FreeType, and prioritize internet-facing or user-facing systems that process untrusted font files. Federal agencies must follow the CISA KEV required action (apply vendor mitigations per BOD 22-01) or discontinue use if mitigations are unavailable. | 8.1 | 28% | KEV |
| masshundreds of millions to billions of devices (FreeType is the default font-rendering library bundled in major Linux distributions and Android) |
Full article319 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 06, 2025Vulnerability / Mobile Security
Google has released its monthly security updates for Android with fixes for 46 security flaws, including one vulnerability that it said has been exploited in the wild.
The vulnerability in question is CVE-2025-27363 (CVSS score: 8.1), a high-severity flaw in the System component that could lead to local code execution without requiring any additional execution privileges.
"The most severe of these issues is a high security vulnerability in the System component that could lead to local code execution with no additional execution privileges needed," Google said in a Monday advisory. "User interaction is not needed for exploitation."
It's worth noting that CVE-2025-27363 is rooted in the FreeType open-source font rendering library. It was first disclosed by Facebook in March 2025 as having been exploited in the wild.
The shortcoming has been described as an out-of-bounds write flaw that could result in code execution when parsing TrueType GX and variable font files. The issue has been remediated in FreeType versions higher than 2.13.0.
"There are indications that CVE-2025-27363 may be under limited, targeted exploitation," Google acknowledged in its security bulletin. The exact specifics of the attacks are presently unknown.
Google's May update also resolves eight other flaws in the Android System and 15 flaws in the Framework module that could be abused to facilitate privilege escalation, information disclosure, and denial-of-service.
"Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform," the company said. "We encourage all users to update to the latest version of Android where possible."
Update
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added CVE-2025-27363 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the patches by May 27, 2025.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/05/google-fixes-actively-exploited-android.html