CVE-2025-66034

CVE-2025-66034 is a critical arbitrary file write vulnerability affecting fontTools versions 4.33.0 through 4.60.1. Specifically, the fontTools varLib script can be exploited when processing a malicious .designspace file, leading to remote code execution. This vulnerability carries a CVSS score of 9.8 (Critical), indicating it can be exploited remotely with low complexity and result in complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness among security researchers.