p PatchFirst

CVE-2025-27363

CVE-2025-27363

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

CVSS 8.1 · High · EPSS 27.8% · In KEV · Fix available

Published
Updated

Stack: system

Affected products and versions

  • freetype

    Versions
    • ≥ 0.0.0, ≤ 2.13.0: Affected (semver)

    No fix published

  • freetype Debian:12

    Versions
    • 2.12.1+dfsg-5
    • 2.12.1+dfsg-5+deb12u1
    • 2.12.1+dfsg-5+deb12u2
    • 2.12.1+dfsg-5+deb12u3
    Affected ranges
    • ECOSYSTEM: < 2.12.1+dfsg-5+deb12u4

    Update to 2.12.1+dfsg-5+deb12u4

  • freetype Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.13.1+dfsg-1

    Update to 2.13.1+dfsg-1

  • freetype Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.13.1+dfsg-1

    Update to 2.13.1+dfsg-1

  • freetype Ubuntu:Pro:16.04:LTS

    Versions
    • 2.5.2-4ubuntu2
    • 2.6.1-0.1ubuntu1
    • 2.6.1-0.1ubuntu2
    • 2.6.1-0.1ubuntu2.1
    • 2.6.1-0.1ubuntu2.2
    • 2.6.1-0.1ubuntu2.3
    • 2.6.1-0.1ubuntu2.4
    • 2.6.1-0.1ubuntu2.5
    • 2.6.1-0.1ubuntu2.5+esm1
    Affected ranges
    • ECOSYSTEM: < 2.6.1-0.1ubuntu2.5+esm2

    Update to 2.6.1-0.1ubuntu2.5+esm2

  • freetype Ubuntu:Pro:18.04:LTS

    Versions
    • 2.8-0.2ubuntu2
    • 2.8.1-0.1ubuntu2
    • 2.8.1-0.1ubuntu3
    • 2.8.1-2ubuntu1
    • 2.8.1-2ubuntu2
    • 2.8.1-2ubuntu2.1
    • 2.8.1-2ubuntu2.2
    Affected ranges
    • ECOSYSTEM: < 2.8.1-2ubuntu2.2+esm1

    Update to 2.8.1-2ubuntu2.2+esm1

  • freetype Ubuntu:20.04:LTS

    Versions
    • 2.9.1-4
    • 2.10.1-2
    • 2.10.1-2ubuntu0.1
    • 2.10.1-2ubuntu0.2
    • 2.10.1-2ubuntu0.3
    Affected ranges
    • ECOSYSTEM: < 2.10.1-2ubuntu0.4

    Update to 2.10.1-2ubuntu0.4

  • freetype Ubuntu:22.04:LTS

    Versions
    • 2.10.4+dfsg-1build1
    • 2.10.4+dfsg-1build2
    • 2.11.0+dfsg-1
    • 2.11.1+dfsg-1
    • 2.11.1+dfsg-1build1
    • 2.11.1+dfsg-1ubuntu0.1
    • 2.11.1+dfsg-1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 2.11.1+dfsg-1ubuntu0.3

    Update to 2.11.1+dfsg-1ubuntu0.3

Original sources

Check your server →