CVE-2025-27363: FreeType Out-of-Bounds Write Vulnerability
Vulnerability summary
CVE-2025-27363 is a high (CVSS 8.1) Out-of-bounds Write vulnerability in FreeType. It is known to be exploited: CISA lists it, first on 06-05-2025. EPSS estimates a 27.77% chance of exploitation in the next 30 days, higher than 98% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 11-03-2025PublishedVulnerability first disclosed.
- 06-05-2025Added to CISA KEVFreeType Out-of-Bounds Write Vulnerability
- 27-05-2025CISA remediation dueApply mitigations per vendor instructions.
- 19-04-2026Last modifiedVulnerability information updated.
Description
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · AlpineEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
27.77%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 27.77% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 06-05-2025
- Federal due date
- 27-05-2025
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2025-27363
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse37 products
- freetype2&distro=SUSE Enterprise Storage 7.1< 2.10.4-150000.4.18.1
- freetype2&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 2.10.4-150000.4.18.1
- freetype2&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 2.10.4-150000.4.18.1
- freetype2&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 2.10.4-150000.4.18.1
- freetype2&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 2.10.4-150000.4.18.1
Redhat16 products
- freetype< 0:2.9.1-7.el8_4 | < 0:2.10.4-10.el9_4 | < 0:2.10.4-10.el9_2 | < 0:2.9.1-6.el8_6.3 | < 0:2.9.1-10.el8_8 | < 0:2.10.4-7.el9_0 | < 0:2.9.1-5.el8_2.1 | < 0:2.8-15.el7_9.1 | < 0:2.10.4-10.el9_5 | < 0:2.9.1-10.el8_10
- freetype-debuginfo< 0:2.9.1-7.el8_4 | < 0:2.10.4-10.el9_4 | < 0:2.10.4-10.el9_2 | < 0:2.9.1-6.el8_6.3 | < 0:2.9.1-10.el8_8 | < 0:2.10.4-7.el9_0 | < 0:2.9.1-5.el8_2.1 | < 0:2.8-15.el7_9.1 | < 0:2.10.4-10.el9_5 | < 0:2.9.1-10.el8_10
- freetype-debugsource< 0:2.9.1-7.el8_4 | < 0:2.10.4-10.el9_4 | < 0:2.10.4-10.el9_2 | < 0:2.9.1-6.el8_6.3 | < 0:2.9.1-10.el8_8 | < 0:2.10.4-7.el9_0 | < 0:2.9.1-5.el8_2.1 | < 0:2.10.4-10.el9_5 | < 0:2.9.1-10.el8_10
- freetype-demos< 0:2.8-15.el7_9.1
- freetype-demos-debuginfo< 0:2.9.1-7.el8_4 | < 0:2.10.4-10.el9_4 | < 0:2.10.4-10.el9_2 | < 0:2.9.1-6.el8_6.3 | < 0:2.9.1-10.el8_8 | < 0:2.10.4-7.el9_0 | < 0:2.9.1-5.el8_2.1 | < 0:2.10.4-10.el9_5 | < 0:2.9.1-10.el8_10
Debian2 products
- freetype< 2.13.1+dfsg-1 | < 2.12.1+dfsg-5+deb12u4 | < 2.10.4+dfsg-1+deb11u2
- debian_linuxEOL11.0
Opensuse2 products
- freetype2&distro=openSUSE Leap 15.6< 2.10.4-150000.4.18.1
- ft2demos&distro=openSUSE Leap 15.6< 2.10.4-150000.4.18.1
Alpine1 product
- freetype< 2.13.1-r0
Freetype1 product
- freetype≥ 0.0.0, ≤ 2.13.0 | ≤ 2.13.0
Mageia1 product
- freetype2< 2.13.0-1.2.mga9 | < 2.13.0-1.2.mga9.tainted
Ubuntu1 product
- freetype< 2.6.1-0.1ubuntu2.5+esm2 | < 2.8.1-2ubuntu2.2+esm1 | < 2.10.1-2ubuntu0.4 | < 2.11.1+dfsg-1ubuntu0.3
8 vendors · 61 products
References
64 links- www.facebook.com/security/advisories/cve-2025-27363X Refsource CONFIRMARTICLEREPORTThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27363Government ResourceUS Government Resource
- www.openwall.com/lists/oss-security/2025/03/13/1Mailing List
- www.openwall.com/lists/oss-security/2025/03/13/2Mailing List
- www.openwall.com/lists/oss-security/2025/03/13/3Mailing List
- www.openwall.com/lists/oss-security/2025/03/13/8Mailing List
- www.openwall.com/lists/oss-security/2025/03/14/1Mailing List
Show all 64 references
- www.openwall.com/lists/oss-security/2025/03/14/2Mailing List
- www.openwall.com/lists/oss-security/2025/03/14/3Mailing List
- www.openwall.com/lists/oss-security/2025/03/14/4Mailing List
- www.openwall.com/lists/oss-security/2025/05/06/3Mailing List
- www.openwall.com/lists/oss-security/2026/04/16/5Mailing List
- www.openwall.com/lists/oss-security/2026/04/19/3Mailing List
