chushpan
Professional
- Messages
- 891
- Reaction score
- 650
- Points
- 93
Meta has warned that a security vulnerability affecting the open-source font rendering library FreeType could be exploited in the wild.
The vulnerability has been assigned the CVE identifier CVE-2025-27363 and a CVSS score of 8.1, indicating a high severity rating. Described as an out-of-bounds write flaw, it could be used to execute remote code when parsing certain font files.🗞 “FreeType versions 2.13.0 and below experience an out-of-bounds write when attempting to parse font subglyph structures related to TrueType GX font files and variables”, the company said in a statement.
“The vulnerable code assigns a signed short value to an unsigned long, then adds a static value, causing it to wrap and allocate a heap buffer that is too small. The code then writes up to 6 signed long integers that exceed the bounds of that buffer. This could lead to arbitrary code execution”.
The company did not provide any details on how exactly the flaw is exploited, who is behind it, or the scale of the attacks. However, it acknowledged that the bug “could be exploited in the wild”.