Fb is warning {that a} FreeType vulnerability in all variations as much as 2.13 can result in arbitrary code execution, with experiences that the flaw has been exploited in assaults.
FreeType is a well-liked open-source font rendering library used to show textual content and programmatically add textual content to photographs. It offers performance to load, rasterize, and render fonts in varied codecs, comparable to TrueType (TTF), OpenType (OTF), and others.
The library is put in in thousands and thousands of techniques and providers, together with Linux, Android, sport engines, GUI frameworks, and on-line platforms.
The vulnerability, tracked underneath CVE-2025-27363 and given a CVSS v3 severity rating of 8.1 (“excessive”), was mounted in FreeType model 2.13.0 on February ninth, 2023.
Fb disclosed the flaw yesterday, warning that the vulnerability is exploitable in all variations of FreeType as much as model 2.13 and that there are experiences of it actively being exploited in assaults.
“An out of bounds write exists in FreeType variations 2.13.0 and under when trying to parse font subglyph buildings associated to TrueType GX and variable font information,” reads the bulletin.
“The susceptible code assigns a signed brief worth to an unsigned lengthy after which provides a static worth inflicting it to wrap round and allocate too small of a heap buffer.”
“The code then writes as much as 6 signed lengthy integers out of bounds relative to this buffer. This may increasingly end in arbitrary code execution.”
Fb could depend on FreeType in some capability, however it’s unclear if the assaults seen by its security staff occurred on its platform or if they found them elsewhere.
Contemplating the widespread use of FreeType throughout a number of platforms, software program builders and challenge directors should improve to FreeType 2.13.3 (newest model) as quickly as doable.
Though the most recent susceptible model (2.13.0) dates two years, older library variations can persist in software program tasks for prolonged intervals, making it essential to deal with the flaw as quickly as doable.
BleepingComputer requested Meta in regards to the flaw and the way it was exploited, and was despatched the next assertion.
“We report security bugs in open supply software program once we discover them as a result of it strengthens on-line security for everybody,” Fb instructed BleepingComputer.
“We predict customers anticipate us to maintain engaged on methods to enhance security. We stay vigilant and dedicated to defending individuals’s personal communications.”
Based mostly on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK strategies behind 93% of assaults and how you can defend in opposition to them.
