CVE-2025-27363highunder attackCWE-787

CVE-2025-27363: high-severity vulnerability in FreeType

Published 11 Mar 2025 · Updated 19 Apr 2026

78Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.1epss 28%

from disclosure to weapon12 days

Published on NVDMar 11

1st PoC+12d

CISA KEV+56d

exploitation probability

28%top 2% of all CVEs

observed exploitation

yesCISA + VulnCheck

5 public exploit(s)

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Affected

1 product (4 components)

Red Hat Enterprise Linux 6

workaround: By restricting the sources from which font files can be loaded allowing only fonts from trusted sources, as well as validating the input for font files to avoid malformed font structures or any data which could trigger the vulnerability would…

Fixed

31 products (379 components)

Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS E4S (v.8.6) · Red Hat Enterprise Linux BaseOS EUS (v.8.8) · Red Hat Enterprise Linux Server (v. 7 ELS) · Red Hat Enterprise Linux AppStream (v. 9) · and others 26

fix ↗

Not affected

8 products (510 components) — because the vulnerable code is not present in the product

Red Hat OpenShift Container Platform 4.12 · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 7 · and others 3

Action required by CISAfederal deadline: 2025-05-27

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

FreeType font rendering library has a memory overflow bug when processing certain variable fonts. An attacker can craft a malicious font file that, when opened, writes data beyond allocated memory boundaries and potentially runs malicious code.

Technical detail

Out-of-bounds write in FreeType ≤2.13.0 during TrueType GX/variable font subglyph parsing due to signed-to-unsigned conversion and integer wrap-around in heap buffer allocation. Attack vector: processing untrusted font files; impact: arbitrary code execution with application privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:H/MI:H/MA:H

Affected products

FreeType · FreeType

public PoCs found — 5

githubgithub.com/zhuowei/CVE-2025-27363-proof-of-concept★ 38 githubgithub.com/tin-z/CVE-2025-27363★ 31 githubgithub.com/ov3rf1ow/CVE-2025-27363★ 3 vulncheckvulncheck.com/xdb/e5445691adbbunverified vulncheckvulncheck.com/xdb/569152d4e850unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — FreeType

In the same product, most dangerous first.

CVE-2025-23022MEDIUMCVE-2025-23022EPSS 0.2%CVE-2026-23865MEDIUMCVE-2026-23865EPSS 0.1%

References