Meta Warns of FreeType Vulnerability

March 13, 2025
Posted by: Evans Asare

Meta Warns of FreeType vulnerability (CVE-2025-27363) with active exploitation risk. Meta has warned that a security vulnerability impacting the FreeType open-source font rendering library may have been exploited in the wild.

The vulnerability has been assigned the CVE identifier CVE-2025-27363, and carries a CVSS score of 8.1, indicating high severity. Described as an out-of-bounds write flaw, it could be exploited to achieve remote code execution when parsing certain font files.

“An out-of-bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files,” the company said in an advisory.

“The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution.”

The company did not share any specifics on how the shortcoming is being exploited, who is behind it, and the scale of the attacks. However, it acknowledged that the bug “may have been exploited in the wild.”

When reached for comment, FreeType developer Werner Lemberg told The Hacker News that a fix for the vulnerability has been incorporated for almost two years. “FreeType versions larger than 2.13.0 are no longer affected,” Lemberg said.