CVE-2025-66034
Medium · 6.3CVSS
6.3
EPSS
0.5%
Published
Nov 29, 2025
CISA due date
—
The record
fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | fonttools | 4.33.0 | 4.60.2 |
| Chainguard | mlflow | 0 | 3.6.0-r1 |
| Chainguard | mlflow-bitnami | 0 | 3.6.0-r1 |
| Chainguard | mlflow-iamguarded-compat | 0 | 3.6.0-r1 |
| Chainguard | open-webui-compat | 0 | 0.6.41-r0 |
| Chainguard | tensorflow-cpu-jupyter | 0 | 2.20.0-r5 |
| Chainguard | tensorflow-gpu-jupyter | 0 | 2.20.0-r4 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | python-FontTools | 0 | 4.47.2-150600.3.3.1 |
| Wolfi | mlflow | 0 | 3.6.0-r1 |
| Wolfi | mlflow-bitnami | 0 | 3.6.0-r1 |
| Wolfi | mlflow-iamguarded-compat | 0 | 3.6.0-r1 |
| Wolfi | open-webui-compat | 0 | 0.6.41-r0 |
| Wolfi | tensorflow-cpu-jupyter | 0 | 2.20.0-r5 |
| openSUSE:Leap 15.6 | python-FontTools | 0 | 4.47.2-150600.3.3.1 |
| openSUSE:Leap 16.0 | python-FontTools | 0 | 4.53.1-160000.3.1 |
| openSUSE:Tumbleweed | python-FontTools | 0 | 4.61.1-1.1 |
| pypi | fonttools | 4.33.0 | No fix |
Related vulnerabilities
- CVE-2026-25645 Requests is a HTTP library. Also affects mlflow
- CVE-2026-30922 pyasn1 is a generic ASN.1 library for Python. Also affects mlflow
- CVE-2026-27205 Flask is a web server gateway interface (WSGI) web application framework. Also affects mlflow
- CVE-2026-27199 Werkzeug is a comprehensive WSGI web application library. Also affects mlflow
- CVE-2026-25990 Pillow is a Python imaging library. Also affects mlflow
- CVE-2026-26007 cryptography is a package designed to expose cryptographic primitives and recipes to… Also affects mlflow
- CVE-2026-0994 A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict()… Also affects mlflow
- CVE-2026-24049 wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. Also affects mlflow