p PatchFirst

CVE-2025-66034

CVE-2025-66034 · fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

This page contains facts from public vulnerability sources. Check the original advisory before updating.

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2.

CVSS 6.3 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • fonttools

    Versions
    • >= 4.33.0, < 4.60.2: Affected

    No fix published

  • fonttools Debian:12

    Versions
    • 4.38.0-1
    Affected ranges
    • ECOSYSTEM: < 4.38.0-1+deb12u1

    Update to 4.38.0-1+deb12u1

  • fonttools Debian:13

    Versions
    • 4.57.0-1
    Affected ranges
    • ECOSYSTEM: < 4.57.0-1+deb13u1

    Update to 4.57.0-1+deb13u1

  • fonttools Debian:14

    Versions
    • 4.57.0-1
    • 4.57.0-2
    • 4.57.0-3
    Affected ranges
    • ECOSYSTEM: < 4.61.1-1

    Update to 4.61.1-1

  • fonttools PyPI

    Versions
    • 4.33.0
    • 4.33.1
    • 4.33.2
    • 4.33.3
    • 4.34.0
    • 4.34.1
    • 4.34.2
    • 4.34.3
    • 4.34.4
    • 4.35.0
    • 4.36.0
    • 4.37.0
    • 4.37.1
    • 4.37.2
    • 4.37.3
    • 4.37.4
    • 4.38.0
    • 4.38.1.dev0
    • 4.39.0
    • 4.39.1
    • 4.39.2
    • 4.39.3
    • 4.39.4
    • 4.40.0
    • 4.41.0
    • 4.41.1
    • 4.42.0
    • 4.42.1
    • 4.43.0
    • 4.43.1
    • 4.44.0
    • 4.44.1
    • 4.44.3
    • 4.45.0
    • 4.45.1
    • 4.46.0
    • 4.47.0
    • 4.47.2
    • 4.48.1
    • 4.49.0
    • 4.50.0
    • 4.51.0
    • 4.52.1
    • 4.52.3
    • 4.52.4
    • 4.53.0
    • 4.53.1
    • 4.54.0
    • 4.54.1
    • 4.55.0
    • 4.55.1
    • 4.55.2
    • 4.55.3
    • 4.55.4
    • 4.55.5
    • 4.55.6
    • 4.55.7
    • 4.55.8
    • 4.56.0
    • 4.57.0
    • 4.58.0
    • 4.58.1
    • 4.58.2
    • 4.58.3
    • 4.58.4
    • 4.58.5
    • 4.59.0
    • 4.59.1
    • 4.59.2
    • 4.60.0
    • 4.60.1
    Affected ranges
    • ECOSYSTEM: ≥ 4.33.0, < 4.60.2

    Update to 4.60.2

  • fonttools Ubuntu:Pro:24.04:LTS

    Versions
    • 4.38.0-1build1
    • 4.38.0-1build2
    • 4.46.0-1
    • 4.46.0-1build2
    Affected ranges
    • ECOSYSTEM: < 4.46.0-1ubuntu0.1~esm1

    Update to 4.46.0-1ubuntu0.1~esm1

  • fonttools Ubuntu:25.10

    Versions
    • 4.55.3-2build1
    Affected ranges
    • ECOSYSTEM: < 4.55.3-2ubuntu0.25.10.1

    Update to 4.55.3-2ubuntu0.25.10.1

  • fonttools Ubuntu:26.04:LTS

    Versions
    • 4.55.3-2build1
    • 4.57.0-1
    • 4.57.0-2build1
    • 4.57.0-3
    Affected ranges
    • ECOSYSTEM: < 4.57.0-3ubuntu1

    Update to 4.57.0-3ubuntu1

Original sources

Check your server →