CVE-2025-27363

CVE-2025-27363 is an out-of-bounds write vulnerability (CWE-787) affecting FreeType versions 2.13.0 and earlier. The flaw occurs during parsing of font subglyph structures in TrueType GX and variable font files, where a signed short value is assigned to an unsigned long, followed by addition of a static value that causes integer wrap-around. This results in allocation of an undersized heap buffer, after which up to six signed long integers are written out of bounds relative to the buffer.

Unauthenticated remote attackers can exploit the vulnerability over the network (AV:N), though it requires high attack complexity (AC:H) and no user interaction (UI:N) or privileges (PR:N). Successful exploitation can lead to arbitrary code execution, with high impacts on confidentiality, integrity, and availability (CVSS:3.1 base score of 8.1; C:H/I:H/A:H, S:U).

Mitigation requires upgrading to newer versions of FreeType, which are not vulnerable. Relevant advisories and discussions are available at https://www.facebook.com/security/advisories/cve-2025-27363 and oss-security mailing list threads including http://www.openwall.com/lists/oss-security/2025/03/13/1, http://www.openwall.com/lists/oss-security/2025/03/13/11, http://www.openwall.com/lists/oss-security/2025/03/13/12, and http://www.openwall.com/lists/oss-security/2025/03/13/2.

This vulnerability may have been exploited in the wild.