CVE-2025-27363
FreeType Out-of-Bounds Write Vulnerability
Description
CVE-2025-27363 is a high-severity out-of-bounds write vulnerability in FreeType, one of the most widely used open-source font rendering libraries. The flaw exists in versions 2.13.0 and below when parsing TrueType GX and variable font subglyph structures, where a signed-to-unsigned type confusion causes an undersized heap buffer allocation, leading to out-of-bounds writes that may result in arbitrary code execution. With a CVSS v3.1 base score of 8.1, this vulnerability is particularly impactful because FreeType is embedded in countless applications and operating systems including Android, Linux distributions, and many third-party software products. CISA added CVE-2025-27363 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 27, 2025, and its EPSS score of 76.15% at the 98th percentile reflects widespread active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| freetype | freetype | <= 2.13.0 |
| debian | debian linux | 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.facebook.com/security/advisories/cve-2025-27363(Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2025/03/13/1(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/03/13/11(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/03/13/12(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/03/13/2(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/03/13/3(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/03/13/8(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/03/14/1(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/03/14/2(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/03/14/3(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/03/14/4(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/05/06/3(Mailing List)
- http://www.openwall.com/lists/oss-security/2026/04/16/5(Mailing List)
- http://www.openwall.com/lists/oss-security/2026/04/19/3(Mailing List)
- https://lists.debian.org/debian-lts-announce/2025/03/msg00030.html(Mailing List)
- https://source.android.com/docs/security/bulletin/2025-05-01(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27363(US Government Resource)
Weakness Type
CWE-787: Out-of-Bounds Write
CVE-2025-27363 is classified under CWE-787, Out-of-Bounds Write. This weakness occurs when software writes data past the end or before the beginning of an allocated memory buffer, potentially corrupting adjacent memory, crashing the application, or enabling arbitrary code execution. In FreeType, the out-of-bounds write is triggered during parsing of font subglyph structures in TrueType GX and variable font files, where a type confusion between signed and unsigned integers leads to an undersized buffer allocation followed by writes beyond the buffer boundary.
Learn more: CWE-787 — Out-of-Bounds Write
Impact Analysis
CVE-2025-27363 carries a CVSS v3.1 score of 8.1 (High) with a network attack vector (AV:N) but high attack complexity (AC:H), requiring no privileges (PR:N) and no user interaction (UI:N). Despite the high complexity requirement, all three impact dimensions are rated high. Confidentiality and integrity face maximum impact because successful exploitation can achieve arbitrary code execution in the context of the application using FreeType, potentially granting access to all data and functionality accessible to that process. Availability is at high risk due to the memory corruption that can crash applications or destabilize the system. The true severity of this vulnerability is amplified by FreeType's ubiquity: it is used by Android (as noted in the Android Security Bulletin 2025-05-01), virtually all Linux distributions including Debian, Chrome, Firefox, and thousands of applications that render fonts. The EPSS score of 76.15% at the 98th percentile confirms that exploitation is not merely theoretical, and the description itself notes this vulnerability "may have been exploited in the wild."
Exploit Maturity
CVE-2025-27363 shows very high exploit maturity with confirmed exploitation in the wild. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on May 6, 2025, and the original disclosure from Meta/Facebook noted that this vulnerability "may have been exploited in the wild." The EPSS score of 76.15% at the 98th percentile places it among the top 2% of all vulnerabilities for exploitation probability. While no explicitly tagged exploit code appears in the NVD references, the extensive discussion on the oss-security mailing list, the Android Security Bulletin inclusion, and the Debian security advisory all confirm the severity and active exploitation status. The vulnerability's presence in a library as fundamental as FreeType means that exploit development benefits from widely available source code analysis, and a single working exploit can target numerous platforms and applications.
Remediation
-
Update FreeType to version 2.13.1 or later across all systems and applications. FreeType versions above 2.13.0 are not vulnerable. For Debian 11 systems, apply the security update referenced in the Debian LTS announcement.
-
Apply the Android May 2025 security patch on all Android devices. The Android Security Bulletin 2025-05-01 includes the fix for this vulnerability.
-
Audit applications that bundle FreeType for embedded or statically linked copies. Many applications ship their own FreeType builds rather than using the system library. Identify and update these bundled copies, paying particular attention to image processing tools, PDF readers, web browsers, and graphical applications.
-
Implement exploit mitigations at the operating system level, including ASLR, stack canaries, and sandboxing for font rendering processes. These do not prevent the vulnerability but increase the difficulty of achieving reliable code execution.
-
Monitor for suspicious font files in environments where users can upload or share document files containing embedded fonts. Consider implementing content inspection that can detect malformed TrueType GX and variable font structures before they reach FreeType for rendering.
Technical Details
CVE-2025-27363 is an out-of-bounds write (CWE-787) in FreeType versions 2.13.0 and below, specifically in the code that parses font subglyph structures for TrueType GX and variable font files. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a network-exploitable vulnerability with high complexity but no authentication or interaction requirements. The root cause is a type confusion where the code assigns a signed short value to an unsigned long variable, then adds a static value that causes the unsigned long to wrap around to a small number. This wrapped value is used to allocate a heap buffer that is significantly smaller than needed. The code then proceeds to write up to six signed long integers past the end of this undersized buffer, corrupting adjacent heap memory. An attacker can trigger this condition by crafting a malicious font file with specific subglyph structure values and delivering it to any application that uses FreeType for font rendering, whether through a web page, document, email, or any other channel that processes fonts.
Frequently Asked Questions
Is CVE-2025-27363 being actively exploited?
Yes. CVE-2025-27363 has been confirmed as exploited in the wild, as noted in both the original Meta/Facebook disclosure and CISA's KEV catalog listing from May 6, 2025. The EPSS score of 76.15% at the 98th percentile reflects intense exploitation activity.
What products are affected by CVE-2025-27363?
FreeType versions 2.13.0 and below are affected. Since FreeType is a foundational library, this impacts Android devices, Debian Linux 11, and thousands of applications across all platforms that use FreeType for font rendering. Versions above 2.13.0 are not vulnerable.
How do I fix CVE-2025-27363?
Update FreeType to version 2.13.1 or later. On Android devices, apply the May 2025 security update. For Linux distributions, apply available security patches. Additionally, audit applications for statically linked or bundled FreeType copies that need independent updating.
How severe is CVE-2025-27363?
CVE-2025-27363 has a CVSS score of 8.1 (High) and can lead to arbitrary code execution through a crafted font file. The vulnerability's severity is amplified by FreeType's near-universal deployment across operating systems and applications. The 98th percentile EPSS ranking confirms this is one of the most actively exploited vulnerabilities currently tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.