PT-2025-48353 · Fonttools+3 · Fonttools+3

Published 2025-11-29 · Updated 2026-03-22 · CVE-2025-66034

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions fontTools versions 4.33.0 through 4.60.1

Description fontTools is a Python library used for manipulating fonts. A flaw exists in the fontTools.varLib script, specifically within the main() code path, which can lead to arbitrary file write and potential remote code execution when processing a malicious .designspace file. This issue impacts the fontTools.varLib command-line interface and any code that calls fontTools.varLib.main().

Recommendations Update fontTools to version 4.60.2 or later.

Exploit

Fix

LPE

RCE

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2025-66034

GHSA-768J-98CG-P3FV

OPENSUSE-SU-2026:10076-1

OPENSUSE-SU-2026:20119-1

SUSE-SU-2026:0199-1

SUSE-SU-2026:20184-1

USN-7917-1

Affected Products

Debian

Linuxmint

Ubuntu

Fonttools

References · 38

• 🔥 https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66034.json · Exploit
• https://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32 · Patch
• https://ubuntu.com/security/CVE-2023-45139 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7917-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-66034 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-66034 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20119-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-66034 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7917-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-768j-98cg-p3fv · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10076-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-66034 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:20184-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66034 · Security Note