CVE-2025-27363
FreeType Out-of-Bounds Write Vulnerability - [Actively Exploited]
Description
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
INFO
Published Date :
March 11, 2025, 2:15 p.m.
Last Modified :
May 7, 2025, 4 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
5.9
Exploitability Score :
2.2
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see https://source.android.com/docs/security/bulletin/2025-05-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-27363
Public PoC/Exploit Available at Github
CVE-2025-27363 has a 6 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-27363.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
None
None
Shell Python
CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild and CryptoGen Nepal aims to simplify this for the general public in a more understandable way as well as in a format that can be easily integrated into their threat intelligence systems.
cve json rss cgn cisa kev
Python HTML
None
Shell Ruby HTML JavaScript SCSS Python
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-27363 vulnerability anywhere in the article.
-
The Hacker News
Chinese Hackers Exploit SAP RCE Flaw CVE-2025-31324, Deploy Golang-Based SuperShell
Vulnerability / Industrial Security A China-linked unnamed threat actor dubbed Chaya_004 has been observed exploiting a recently disclosed security flaw in SAP NetWeaver. Forescout Vedere Labs, in a r ... Read more
-
The Hacker News
SonicWall Patches 3 Flaws in SMA 100 Devices Allowing Attackers to Run Code as Root
Network Security / Vulnerability SonicWall has released patches to address three security flaws affecting SMA 100 Secure Mobile Access (SMA) appliances that could be fashioned to result in remote code ... Read more
-
TheCyberThrone
CISA Adds GeoVision Vulnerabilities to KEV Catalog
The Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting GeoVision surveillance devices to its Known Exploited Vulnerabilities (KEV) Catalog, citing ... Read more
-
Help Net Security
Yet another SonicWall SMA100 vulnerability exploited in the wild (CVE-2025-32819)
SonicWall has fixed multiple vulnerabilities affecting its SMA100 Series devices, one of which (CVE-2025-32819) appears to be a patch bypass for an arbitrary file delete vulnerability that was exploit ... Read more
-
The Cyber Express
Nmap 7.96 Launches with Lightning-Fast DNS and 612 Scripts
The Nmap Project has officially launched the highly anticipated Nmap 7.96, bringing a wealth of new features, performance upgrades, and bug fixes to the popular network scanning tool. As a fundamental ... Read more
-
The Cyber Express
CVE-2025-20188: Cisco Fixes 10.0-Rated Wireless Controller Flaw
Cisco has rolled out software patches to address a severe security vulnerability, tracked as CVE-2025-20188, in its IOS XE Wireless Controller software. The flaw, which has been assigned the highest p ... Read more
-
The Hacker News
Cisco Patches CVE-2025-20188 (10.0 CVSS) in IOS XE That Enables Root Exploits via JWT
Vulnerability / Network Security Cisco has released software fixes to address a maximum-severity security flaw in its IOS XE Wireless Controller that could enable an unauthenticated, remote attacker t ... Read more
-
Help Net Security
Actively exploited FreeType flaw fixed in Android (CVE-2025-27363)
Google has released fixes for a bucketload of Android security vulnerabilities, including a FreeType flaw (CVE-2025-27363) that “may be under limited, targeted exploitation.” About CVE-2025-27363 CVE- ... Read more
-
TheCyberThrone
CISA Adds CVE-2025-27363 to KEV Catalog
The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-27363, a critical out-of-bounds write vulnerability in FreeType, to its Known Exploited Vulnerabilities (KEV) Catalog due ... Read more
-
BleepingComputer
Google fixes actively exploited FreeType flaw on Android
Google has released the May 2025 security updates for Android with fixes for 45 security flaws, including an actively exploited zero-click FreeType 2 code execution vulnerability. FreeType is a popula ... Read more
-
Cyber Security News
Android Security Update – Critical Patch Released for Actively Exploited Vulnerability
Google has released the Android Security Bulletin for May 2025, addressing multiple vulnerabilities, including a high-severity remote code execution flaw that is actively being exploited in the wild. ... Read more
-
The Hacker News
Google Fixes Actively Exploited Android System Flaw in May 2025 Security Update
Vulnerability / Mobile Security Google has released its monthly security updates for Android with fixes for 46 security flaws, including one vulnerability that it said has been exploited in the wild. ... Read more
-
security.nl
Google komt met Android-updates voor aangevallen FreeType-lek
Google heeft Android-updates uitgebracht voor een actief aangevallen kwetsbaarheid in FreeType die remote code execution mogelijkt. Begin maart waarschuwde Facebook al voor het probleem. FreeType is e ... Read more
-
Daily CyberSecurity
Critical IBM Cognos Analytics Vulnerabilities Demand Urgent Patching
IBM has released security updates to address two critical vulnerabilities affecting its flagship business intelligence platform, IBM Cognos Analytics, warning that attackers could exploit these flaws ... Read more
-
Daily CyberSecurity
Android Security Bulletin May 2025: Multi Vulnerabilities Including Actively Exploited CVE-2025-27363
Google has released its Android Security Bulletin for May 2025, highlighting a range of high-severity vulnerabilities affecting Android OS components, third-party chipsets, and the popular FreeType li ... Read more
-
Daily CyberSecurity
Langflow Under Attack: CISA Warns of Active Exploitation of CVE-2025-3248
Image: Horizon3.ai The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2025-3248 to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active e ... Read more
The following table lists the changes that have been made to the
CVE-2025-27363 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
May. 07, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:* versions up to (including) 2.13.0 Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2025/03/13/1 Types: Mailing List Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2025/03/13/11 Types: Mailing List Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2025/03/13/12 Types: Mailing List Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2025/03/13/2 Types: Mailing List Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2025/03/13/3 Types: Mailing List Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2025/03/13/8 Types: Mailing List Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2025/03/14/1 Types: Mailing List Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2025/03/14/2 Types: Mailing List Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2025/03/14/3 Types: Mailing List Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2025/03/14/4 Types: Mailing List Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2025/05/06/3 Types: Mailing List Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2025/03/msg00030.html Types: Mailing List Added Reference Type CISA-ADP: https://source.android.com/docs/security/bulletin/2025-05-01 Types: Third Party Advisory Added Reference Type Facebook, Inc.: https://www.facebook.com/security/advisories/cve-2025-27363 Types: Third Party Advisory -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
May. 07, 2025
Action Type Old Value New Value Added Date Added 2025-05-06 Added Due Date 2025-05-27 Added Required Action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Added Vulnerability Name FreeType Out-of-Bounds Write Vulnerability -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
May. 06, 2025
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2025/05/06/3 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 06, 2025
Action Type Old Value New Value Added Reference https://source.android.com/docs/security/bulletin/2025-05-01 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Apr. 02, 2025
Action Type Old Value New Value Added Reference https://lists.debian.org/debian-lts-announce/2025/03/msg00030.html -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 14, 2025
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2025/03/14/4 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 14, 2025
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2025/03/14/3 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 14, 2025
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2025/03/14/2 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 14, 2025
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2025/03/14/1 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 14, 2025
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2025/03/13/12 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 13, 2025
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2025/03/13/11 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 13, 2025
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2025/03/13/8 -
CVE Modified by [email protected]
Mar. 13, 2025
Action Type Old Value New Value Changed Description An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild. An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild. -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 13, 2025
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2025/03/13/3 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 13, 2025
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2025/03/13/1 Added Reference http://www.openwall.com/lists/oss-security/2025/03/13/2 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Mar. 11, 2025
Action Type Old Value New Value Added CWE CWE-787 -
New CVE Received by [email protected]
Mar. 11, 2025
Action Type Old Value New Value Added Description An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild. Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Added Reference https://www.facebook.com/security/advisories/cve-2025-27363
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-27363 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-27363
weaknesses.