CVE-2025-27363

What it actually does

The flaw is a heap memory corruption issue in FreeType 2.13.0 and earlier when parsing TrueType GX and variable font subglyph structures. A signed short is converted to an unsigned long and then incremented, causing integer wraparound and an undersized heap allocation; subsequent parsing can write several signed long values beyond the allocated buffer. If an affected application, service, renderer, or operating system component processes a crafted font, the out-of-bounds write can crash the process or potentially allow attacker-controlled code execution with the privileges of the process doing the font parsing.

Why it matters to the business

Successful exploitation can let an attacker compromise systems through crafted fonts embedded in documents, webpages, images, PDFs, emails, or uploaded content processed by vulnerable software. Because this vulnerability is listed in CISA KEV, has active in-the-wild exploitation reporting, and had a KEV remediation deadline of 2025-05-27, unpatched systems should be treated as high-priority exposure even though exploitation may require a carefully crafted font and a vulnerable parsing path. Operational consequences include endpoint compromise, service takeover, data theft, malware installation, and outages in applications that render or inspect untrusted font content.

How an attack unfolds

An attacker prepares a malformed TrueType GX or variable font that triggers the signed-to-unsigned conversion and heap allocation mismatch in vulnerable FreeType code. The font is then delivered through a channel where it will be parsed automatically or semi-automatically, such as a webpage, document, PDF, email attachment, image-processing workflow, file previewer, print/rendering pipeline, or upload-scanning service. When the vulnerable parser processes the subglyph data, it allocates a buffer that is too small and writes out of bounds. A failed attempt may produce a crash, while a successful exploit may manipulate heap state to execute code in the affected process. Since exploitation has been reported in the wild, organizations should assume adversaries may use this as part of targeted compromise chains, especially against systems that parse untrusted fonts at scale.

How to fix it

Upgrade FreeType to a non-vulnerable release newer than 2.13.0 wherever it is installed, bundled, vendored, or statically linked. Do not rely only on operating system package inventory; browsers, desktop applications, PDF/rendering tools, container images, firmware, appliances, and server-side document/image processing services may carry their own FreeType copy. For the listed Red Hat Enterprise Linux 6 ELS package set, update affected kernel-related packages to 0:2.6.32-754.43.1.el6 or later, including kernel, kernel-debug, kernel-devel, kernel-doc, kernel-firmware, kernel-kdump, perf, python-perf, and associated debuginfo/ABI packages where installed. After patching kernel packages, reboot into the updated kernel. As interim mitigation, restrict processing of untrusted fonts, disable or sandbox font preview/rendering features where feasible, isolate document-conversion and upload-processing workloads, block risky font uploads when business processes allow, and ensure application sandboxing, exploit protection, and memory-hardening controls are enabled.

How to confirm the fix worked

Confirm the deployed FreeType version is newer than 2.13.0 or that vendor packages include the backported fix. On RPM-based systems, verify relevant package versions with package-manager queries and confirm Red Hat Enterprise Linux 6 ELS kernel-related packages are at 0:2.6.32-754.43.1.el6 or later where applicable. Check running processes and application dependencies for dynamically loaded libfreetype libraries, and scan application/container images for bundled or statically linked FreeType copies. For kernel package remediation, verify the running kernel after reboot, not only the installed package version. Validate compensating controls by testing that untrusted font uploads and rendering workflows are blocked, sandboxed, or routed only to patched components. Vulnerability scanners should be configured to detect both OS packages and embedded third-party libraries.

Typical attack path

1. Identify a target application, endpoint component, document renderer, browser component, image/PDF processor, or service that uses FreeType 2.13.0 or earlier, including bundled or statically linked copies.
2. Craft or obtain a malicious TrueType GX or variable font file that triggers the vulnerable subglyph parsing path.
3. Embed or deliver the font through a webpage, document, PDF, email, archive, upload feature, rendering workflow, or other content-processing path.
4. Wait for the vulnerable component to parse the font automatically or during user/content processing.
5. Trigger heap corruption via the undersized allocation and out-of-bounds write.
6. Achieve process crash, denial of service, or code execution with the privileges of the affected process.
7. Use resulting execution to drop malware, access sensitive data, move laterally, or establish persistence.

How to detect it

To determine whether exploitation may already have occurred, review endpoint, server, application, EDR, crash, and content-processing logs for crashes or exploit-prevention events in processes that render or inspect fonts, documents, PDFs, images, webpages, email attachments, or uploads. Focus on events involving libfreetype, freetype, TrueType GX, variable fonts, and recent processing of .ttf, .otf, .ttc, .woff, or .woff2 files, especially shortly before abnormal child process creation, unexpected network connections, or file writes. On Linux systems, search syslog, journald, kernel logs, audit logs, coredump records, and application logs for segmentation faults, heap corruption, allocator aborts, or core dumps tied to renderers, converters, browsers, thumbnailers, print services, email scanners, and upload processors. On Windows and macOS endpoints running software that bundles FreeType, review application crash logs, EDR memory-corruption detections, and suspicious renderer/helper process behavior. Preserve suspicious font files for offline analysis and compare file arrival time, parsing time, crash time, and any subsequent process execution. Because public reporting does not provide a universal exploit filename, IP address, or payload marker, detection should emphasize vulnerable parser crashes plus post-crash execution anomalies rather than network IOCs alone.

• libfreetype
• freetype
• FreeType
• segfault.*libfreetype
• SIGSEGV.*libfreetype
• core dumped.*libfreetype
• malloc(): memory corruption
• malloc(): corrupted top size
• free(): invalid next size
• double free or corruption
• heap-buffer-overflow.*freetype
• AddressSanitizer.*freetype
• TrueType GX
• .ttf
• .otf
• .ttc
• .woff
• .woff2
• gvar
• fvar
• glyf

What your security team should do

• Treat this as urgent because it is in CISA KEV, has reported active exploitation, and the KEV deadline has passed.
• Inventory all FreeType deployments, including OS packages, containers, desktop applications, browsers, PDF/image/document processing tools, appliances, and vendored libraries.
• Prioritize patching internet-facing and high-volume content-processing systems that parse files, documents, images, PDFs, email attachments, or uploaded fonts from untrusted sources.
• Upgrade FreeType to a fixed version newer than 2.13.0 and apply vendor backports; for the listed Red Hat Enterprise Linux 6 ELS packages, update to 0:2.6.32-754.43.1.el6 or later and reboot where required.
• Temporarily disable, restrict, or sandbox untrusted font parsing in upload pipelines, preview services, document conversion systems, and email/content inspection tools until patching is complete.
• Search telemetry for crashes, abnormal renderer exits, exploit-protection events, and suspicious processing of TrueType GX or variable font files before the patch date.
• Review exposed document-rendering and file-upload services for post-exploitation activity, including unexpected child processes, outbound connections, dropped files, and credential access attempts.
• Add regression checks to software composition analysis so future builds fail when FreeType 2.13.0 or earlier is introduced.