# CVE-2025-27363

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

- Page: https://www.vulneraibility.com/cve/CVE-2025-27363
- CVSS: 8.1
- Known exploited: yes, in CISA KEV since 2025-05-06; CISA due date 2025-05-27
- EPSS: 27.77%
- Unvetted proof-of-concept code on GitHub: 3 GitHub proofs of concept (first 2025-03-23)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-05-07)
- Weakness: CWE-787
- Published: 2025-03-11

## Affected versions

- FreeType: affected <= 2.13.0

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.facebook.com/security/advisories/cve-2025-27363
- [advisory] https://source.android.com/docs/security/bulletin/2025-05-01
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27363
- [other] http://www.openwall.com/lists/oss-security/2025/03/13/1
- [other] http://www.openwall.com/lists/oss-security/2025/03/13/2
- [other] http://www.openwall.com/lists/oss-security/2025/03/13/3
- [other] http://www.openwall.com/lists/oss-security/2025/03/13/8
- [other] http://www.openwall.com/lists/oss-security/2025/03/13/11
- [other] http://www.openwall.com/lists/oss-security/2025/03/13/12
- [other] http://www.openwall.com/lists/oss-security/2025/03/14/1
- [other] http://www.openwall.com/lists/oss-security/2025/03/14/2
- [other] http://www.openwall.com/lists/oss-security/2025/03/14/3
- [other] http://www.openwall.com/lists/oss-security/2025/03/14/4
- [other] https://lists.debian.org/debian-lts-announce/2025/03/msg00030.html
- [other] http://www.openwall.com/lists/oss-security/2025/05/06/3
- [other] http://www.openwall.com/lists/oss-security/2026/04/16/5
- [other] http://www.openwall.com/lists/oss-security/2026/04/19/3

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.