Actively exploited FreeType flaw fixed in Android (CVE-2025-27363)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-27363 | Out-of-Bounds Write in FreeType Font Parsing Allows Arbitrary Code Execution FreeType, the widely bundled open-source font rendering library, contains an out-of-bounds write (CWE-787) when parsing subglyph structures in TrueType GX and variable font files. The flaw is triggered when an application using FreeType renders a specially crafted font file, such as one embedded in a document, webpage, or downloaded file. A successful exploit may allow the attacker to execute arbitrary code with the privileges of the application that processed the font. Because FreeType ships by default with virtually all major Linux distributions, Android, and many applications and embedded products, the affected population is extremely broad, though specific affected version ranges are not enumerated in the available data. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on 2025-05-06, indicating confirmed in-the-wild exploitation, and carries a high EPSS probability of 27.8% (98th percentile); no public proof-of-concept code is known. Do: Update FreeType to the latest available release/commit and apply vendor patches for any product that bundles or depends on it, since exact vulnerable version ranges are not stated in the available data. Inventory your environment for software, operating systems, and dependencies that ship FreeType, and prioritize internet-facing or user-facing systems that process untrusted font files. Federal agencies must follow the CISA KEV required action (apply vendor mitigations per BOD 22-01) or discontinue use if mitigations are unavailable. | 8.1 | 28% | KEV |
| masshundreds of millions to billions of devices (FreeType is the default font-rendering library bundled in major Linux distributions and Android) |
Full article395 words · extracted from helpnetsecurity.com · click to collapse
Google has released fixes for a bucketload of Android security vulnerabilities, including a FreeType flaw (CVE-2025-27363) that “may be under limited, targeted exploitation.”
About CVE-2025-27363
CVE-2025-27363 is an out of bounds write vulnerability in FreeType, an open-source software library that renders fonts (thus, text) onto digital displays (e.g., screens) and is used across many platforms, including Android, iOS, macOS, and Linux.
FreeType has been the source of multiple security vulnerabilities over the years, mostly due to malformed font files used to exploit memory handling.
CVE-2025-27363 affects FreeType versions 0.0.0 through 2.13.0 and was flagged by Facebook in March 2025 as possibly exploited in the wild.
The security issue is triggered when a vulnerable version of the library attempts to parse font subglyph structures related to TrueType GX and variable font files.
“The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution,” the company explained.
Facebook and Google did not share any additional details about the attacks. Google only said that the vulnerability could lead to local code execution with no additional execution privileges nor any user interaction needed (i.e., can be exploited in “zero-click” attacks).
As Malwarebytes’ Pieter Arntz noted, “it’s reasonable to assume that simply opening a document or app containing a malicious font could compromise your device.”
Update your Android device(s)
As per usual, the May 2025 Android Security Bulletin includes two security patch levels: the first one addresses general Android vulnerabilities, and the second one addresses those + vulnerabilities specific to certain hardware components or manufacturers, such as Qualcomm, MediaTek, Arm, etc.
This dual patch level system allows device manufacturers flexibility in integrating and deploying updates. They get notified of the issues in advance, but they sometimes lag with pushing out patches for their Android-based devices.
Fixes for the 40+ vulnerabilities addressed in this patch level have been provided for Android versions 13, 14, and 15.
Android users should check whether there are new updates available for their device and upgrade if there are.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/05/07/actively-exploited-freetype-flaw-fixed-in-android-cve-2025-27363/