CVE-2025-27363

79

FAUCET Score

CVE-2025-27363 is an out-of-bounds write vulnerability in FreeType versions 2.13.0 and below, affecting various Debian and FreeType products. This flaw, stemming from an integer overflow during font parsing, allows for arbitrary code execution. With a CVSS score of 8.1 (HIGH) and an EPSS score indicating high exploitability, it presents a significant risk. The vulnerability is actively exploited in the wild, as confirmed by its presence in the KEV catalog and reports of exploitation by Paragon spyware, and has garnered substantial community discussion and media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		<= 2.13.0CPE matchmatch criteria	cpe:2.3:a:freetype:freetype::::::::
		11.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:11.0:::::::*
		>= 0.0.0, <= 2.13.0CPE match	cpe:2.3:a:freetype:freetype::::::::

CVSS Data

CVSS version used by this source: 3.1

8.1HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

2.2

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

26.05%

Probability of exploitation in next 30 days

EPSS Percentile

97.8%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

Added to KEV · May 6, 2025

This CVE's current EPSS score of 0.2605 is in the 91st percentile among its peer group of 8,918 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (38)

codesyspatch availablevia llm_extracted

esphomepatch availablevia llm_extracted

microsoftpatch availablevia msrc

Product: 17906-17086Fixed in: 2.13.1-1

microsoftpatch availablevia msrc

Product: 20108-17086Fixed in: 2.13.1-1

microsoftpatch availablevia msrc

Product: 19394-16823Fixed in: 2.13.1-1

microsoftpatch availablevia msrc

Product: cbl2 freetype 2.13.1-1 on CBL Mariner 2.0Fixed in: 2.13.1-1

microsoftpatch availablevia msrc

Product: cbl2 freetype 2.13.0-1 on CBL Mariner 2.0Fixed in: 2.13.1-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: spice-client-win-0:8.4-2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: freetype-0:2.9.1-7.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: spice-client-win-0:8.4-2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: freetype-0:2.9.1-7.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: spice-client-win-0:8.4-2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: freetype-0:2.9.1-7.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportFixed in: spice-client-win-0:8.6-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportFixed in: freetype-0:2.9.1-6.el8_6.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceFixed in: spice-client-win-0:8.6-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceFixed in: freetype-0:2.9.1-6.el8_6.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsFixed in: spice-client-win-0:8.6-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsFixed in: freetype-0:2.9.1-6.el8_6.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Extended Update SupportFixed in: mingw-freetype-0:2.8-3.el8_8.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Extended Update SupportFixed in: spice-client-win-0:8.8-5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Extended Update SupportFixed in: freetype-0:2.9.1-10.el8_8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: freetype-0:2.10.4-10.el9_5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsFixed in: freetype-0:2.10.4-7.el9_0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Extended Update SupportFixed in: freetype-0:2.10.4-10.el9_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: freetype-0:2.10.4-10.el9_4

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.12Fixed in: openshift4/network-tools-rhel8:v4.12.0-202503310133.p0.gc76613c.assembly.stream.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.12Fixed in: openshift4/ose-kuryr-cni-rhel8:v4.12.0-202503310133.p0.g8fd2f8b.assembly.stream.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.12Fixed in: openshift4/ose-kuryr-controller-rhel8:v4.12.0-202503310133.p0.g8fd2f8b.assembly.stream.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.12Fixed in: openshift4/ose-tests:v4.12.0-202503310133.p0.g893161e.assembly.stream.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.12Fixed in: openshift4/ose-tools-rhel8:v4.12.0-202503310133.p0.gd691257.assembly.stream.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.12Fixed in: rhcos-412.86.202503310142-0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: mingw-freetype-0:2.8-3.el8_10.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 Extended Lifecycle SupportFixed in: freetype-0:2.8-15.el7_9.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: spice-client-win-0:8.10-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: freetype-0:2.9.1-10.el8_10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: spice-client-win-0:8.2-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: freetype-0:2.9.1-5.el8_2.1

Vendor Advisories (4)

codesysllm-codesys-fe85e88fbae25bb9CRITICAL

HP ThinPro 8.1 SP7 Security Updates

esphomellm-esphome-ed450ce9fd6a7380CRITICAL

HP ThinPro 8.1 SP7 Security Updates

redhatCVE-2025-27363Important

freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files

microsoft2025-Mar/CVE-2025-27363Important

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

References

source.android.com / docs/security/bulletin/2025-05-01

Third Party Advisory

cisa.gov / known-exploited-vulnerabilities-catalog

US Government Resource

lists.debian.org / debian-lts-announce/2025/03/msg00030.html

Mailing List

openwall.com / lists/oss-security/2025/03/13/1

Mailing List

openwall.com / lists/oss-security/2025/03/13/11

Mailing List

openwall.com / lists/oss-security/2025/03/13/12

Mailing List

openwall.com / lists/oss-security/2025/03/13/2

Mailing List

openwall.com / lists/oss-security/2025/03/13/3

Mailing List

openwall.com / lists/oss-security/2025/03/13/8

Mailing List

openwall.com / lists/oss-security/2025/03/14/1

Mailing List

openwall.com / lists/oss-security/2025/03/14/2

Mailing List

openwall.com / lists/oss-security/2025/03/14/3

Mailing List

openwall.com / lists/oss-security/2025/03/14/4

Mailing List

openwall.com / lists/oss-security/2025/05/06/3

Mailing List

openwall.com / lists/oss-security/2026/04/16/5

Mailing List

openwall.com / lists/oss-security/2026/04/19/3

Mailing List

facebook.com / security/advisories/cve-2025-27363

Third Party Advisory