CVE-2025-27363

8.1

HIGH

FreeType Out-of-Bounds Write Vulnerability - [Actively Exploited]

Description

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

INFO

Published Date :

March 11, 2025, 2:15 p.m.

Last Modified :

May 7, 2025, 4 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

2.2

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: May 27, 2025 | 3 days left

Alert Date: May 06, 2025 | 17 days ago

Description :

FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see https://source.android.com/docs/security/bulletin/2025-05-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-27363

Public PoC/Exploit Available at Github

CVE-2025-27363 has a 6 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2025-27363 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Debian	debian_linux
1	Freetype	freetype

: Total Affected Vendor : 2 | Products : 2

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-27363.

URL	Resource
https://www.facebook.com/security/advisories/cve-2025-27363	Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/03/13/1	Mailing List
http://www.openwall.com/lists/oss-security/2025/03/13/11	Mailing List
http://www.openwall.com/lists/oss-security/2025/03/13/12	Mailing List
http://www.openwall.com/lists/oss-security/2025/03/13/2	Mailing List
http://www.openwall.com/lists/oss-security/2025/03/13/3	Mailing List
http://www.openwall.com/lists/oss-security/2025/03/13/8	Mailing List
http://www.openwall.com/lists/oss-security/2025/03/14/1	Mailing List
http://www.openwall.com/lists/oss-security/2025/03/14/2	Mailing List
http://www.openwall.com/lists/oss-security/2025/03/14/3	Mailing List
http://www.openwall.com/lists/oss-security/2025/03/14/4	Mailing List
http://www.openwall.com/lists/oss-security/2025/05/06/3	Mailing List
https://lists.debian.org/debian-lts-announce/2025/03/msg00030.html	Mailing List
https://source.android.com/docs/security/bulletin/2025-05-01	Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

delldevmann/cybersecurity-news-tracker

None

Updated: 2 weeks, 1 day ago

2 stars 0 fork 0 watcher

Born at : April 29, 2025, 12:52 a.m. This repo has been linked 4 different CVEs too.

chiprojects/remediation-freetype-vulnerability-usn7532-1

None

Updated: 1 month, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : March 25, 2025, 11:26 p.m. This repo has been linked 1 different CVEs too.

zhuowei/CVE-2025-27363-proof-of-concept

None

Shell Python

Updated: 2 weeks, 2 days ago

10 stars 2 fork 2 watcher

Born at : March 23, 2025, 11:30 p.m. This repo has been linked 1 different CVEs too.

CryptoGenNepal/CVE-KEV-RSS

CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild and CryptoGen Nepal aims to simplify this for the general public in a more understandable way as well as in a format that can be easily integrated into their threat intelligence systems.

cve json rss cgn cisa kev

Python HTML

Updated: 2 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : Feb. 16, 2025, 5:21 p.m. This repo has been linked 1 different CVEs too.

0xAtef/0xAtef.github.io

None

Shell Ruby HTML JavaScript SCSS Python

Updated: 2 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : Aug. 6, 2023, 9:53 a.m. This repo has been linked 4 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 3 weeks, 5 days ago

6873 stars 1158 fork 1158 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 848 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-27363 vulnerability anywhere in the article.

The Hacker News

Chinese Hackers Exploit SAP RCE Flaw CVE-2025-31324, Deploy Golang-Based SuperShell

Vulnerability / Industrial Security A China-linked unnamed threat actor dubbed Chaya_004 has been observed exploiting a recently disclosed security flaw in SAP NetWeaver. Forescout Vedere Labs, in a r ...

Published Date: May 09, 2025 (2 weeks ago)

CVE-2025-31324 CVE-2025-27363

The Hacker News

SonicWall Patches 3 Flaws in SMA 100 Devices Allowing Attackers to Run Code as Root

Network Security / Vulnerability SonicWall has released patches to address three security flaws affecting SMA 100 Secure Mobile Access (SMA) appliances that could be fashioned to result in remote code ...