PT-2025-10753 · Freetype+10 · Freetype+10
Michel Lind
·
Published
2023-03-18
·
Updated
2026-04-19
·
CVE-2025-27363
CVSS v3.1
8.1
High
| AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FreeType versions 2.13.0 and below
Description
FreeType is a free, high-quality, portable font engine. A vulnerability exists in versions 2.13.0 and below due to an out-of-bounds write when parsing font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long, causing a buffer overflow and potentially leading to arbitrary code execution. This vulnerability has been actively exploited in the wild and affects Android systems, as well as potentially other platforms utilizing the FreeType library. The vulnerability has been assigned CVE-2025-27363.
Recommendations
Upgrade to a version of FreeType newer than 2.13.0.
Fix
DoS
LPE
RCE
Memory Corruption
Out of bounds Read
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Debian
Freetype
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu