⚠ Actively exploited
Added to CISA KEV on 2025-05-06. Federal agencies required to patch by 2025-05-27. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..
CVE-2025-27363 — Out-of-bounds Write in External Freetype
Severity
8.1HIGHNVD
OSV7.5
EPSS
70.3%
top 1.31%
CISA KEV
KEV
Added 2025-05-06
Due 2025-05-27
Exploit
No known exploits
Affected products
Timeline
PublishedMar 11
KEV addedMay 6
KEV dueMay 27
Latest updateMar 19
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary cod…
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9
Affected Packages11 packages
Also affects: Debian Linux 11.0
🔴Vulnerability Details
7📋Vendor Advisories
13Oracle▶
Oracle Oracle Construction and Engineering Risk Matrix: Outside In Technology Installer in P6 (FreeType) — CVE-2025-27363↗2025-10-15
Oracle
▶
🕵️Threat Intelligence
3📐Framework References
4💬Community
1Bugzilla▶
CVE-2025-27363: out of bounds write exists in FreeType versions 2.13.0 and below [ESR-115]↗2025-05-07