{"id":"CVE-2025-27363","published":"2025-03-11T14:15:25Z","modified":"2026-06-17T09:03:27Z","title":"FreeType Out-of-Bounds Write Vulnerability","vendor":"FreeType","product":"FreeType","tier":"core","eol":null,"description":{"text":"An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.","provenance":"source","from":"NVD"},"summary":{"text":"FreeType versions 2.13.0 and below contain an out-of-bounds write in the font parsing code that handles subglyph structures for TrueType GX and variable font files. An attacker who can supply a crafted font file to a vulnerable FreeType build could trigger a heap buffer that is too small and write out of bounds, potentially achieving arbitrary code execution; the attack is network-reachable with no authentication or user interaction required, though exploitation is considered high complexity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:34Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.27775,"percentile":0.98089,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-05-06","dueDate":"2025-05-27","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://source.android.com/docs/security/bulletin/2025-05-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-27363","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-03-11","exploitedFirstSeen":"2025-03-11","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2025-03-11"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27363","date":"2025-03-11"},{"url":"https://www.facebook.com/security/advisories/cve-2025-27363","date":"2025-03-11"},{"url":"https://cyberalerts.io/vulnerability/CVE-2025-27363","date":"2025-04-17"},{"url":"https://source.android.com/docs/security/bulletin/2025-05-01","date":"2025-05-05"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-05-06"},{"url":"https://t.me/safebdv/1266","date":"2025-06-17"},{"url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","date":"2025-10-09"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://www.redhat.com/en/resources/product-security-risk-report-2025","date":"2026-04-10"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2025-27363","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/13/1","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/13/11","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/13/12","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/13/2","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/13/3","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/13/8","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/14/1","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/14/2","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/14/3","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/14/4","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2025/05/06/3","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/16/5","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/19/3","tags":["Mailing List"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00030.html","tags":["Mailing List"]},{"url":"https://source.android.com/docs/security/bulletin/2025-05-01","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27363","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"exploitation_technique","evidence":[],"comment":"Out of bounds write exists in FreeType that has been exploited through malicious font files, causing the application to crash. ","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1574","name":"Hijack Execution Flow","tactics":["execution","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"primary_impact","evidence":[],"comment":"Out of bounds write exists in FreeType that has been exploited through malicious font files, causing the application to crash. ","confidence":"high"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"secondary_impact","evidence":[],"comment":"Out of bounds write exists in FreeType that has been exploited through malicious font files, causing the application to crash. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-6367","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6367","exploited":true,"exploitedSince":"2025-05-06","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2025-03-23","earliestUrl":"https://github.com/zhuowei/CVE-2025-27363-proof-of-concept","repos":[{"name":"zhuowei/CVE-2025-27363-proof-of-concept","url":"https://github.com/zhuowei/CVE-2025-27363-proof-of-concept","stars":40,"created":"2025-03-23"},{"name":"tin-z/CVE-2025-27363","url":"https://github.com/tin-z/CVE-2025-27363","stars":32,"created":"2025-07-23"},{"name":"ov3rf1ow/CVE-2025-27363","url":"https://github.com/ov3rf1ow/CVE-2025-27363","stars":3,"created":"2025-05-26"}]},"first":{"date":"2025-03-23","source":"PoC-in-GitHub","url":"https://github.com/zhuowei/CVE-2025-27363-proof-of-concept"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1574"],"provenance":"source"},{"stage":"secondary","techniques":["T1499.004"],"provenance":"source"},{"stage":"related","techniques":["T1204.002"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2025-03-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27363","provenance":"source"},{"date":"2025-03-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2025-03-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/zhuowei/CVE-2025-27363-proof-of-concept","provenance":"source"},{"date":"2025-05-06","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-05-06","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6367","provenance":"source"}],"speed":{"daysToPublicExploit":12,"firstExploitFrom":"PoC-in-GitHub","daysToKev":56},"priority":{"score":68.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 599 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.62,"detail":"percentile 0.9809"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}