Meta has warned {that a} security vulnerability impacting the FreeType open-source font rendering library could have been exploited within the wild.
The vulnerability has been assigned the CVE identifier CVE-2025-27363, and carries a CVSS rating of 8.1, indicating excessive severity. Described as an out-of-bounds write flaw, it could possibly be exploited to attain distant code execution when parsing sure font recordsdata.
“An out-of-bounds write exists in FreeType variations 2.13.0 and under when trying to parse font subglyph buildings associated to TrueType GX and variable font recordsdata,” the corporate mentioned in an advisory.
“The susceptible code assigns a signed brief worth to an unsigned lengthy after which provides a static worth inflicting it to wrap round and allocate too small of a heap buffer. The code then writes as much as 6 signed lengthy integers out of bounds relative to this buffer. This will lead to arbitrary code execution.”
The corporate didn’t share any specifics on how the shortcoming is being exploited, who’s behind it, and the dimensions of the assaults. Nevertheless, it acknowledged that the bug “could have been exploited within the wild.”
When reached for remark, FreeType developer Werner Lemberg instructed The Hacker Information {that a} repair for the vulnerability has been integrated for nearly two years. “FreeType variations bigger than 2.13.0 are not affected,” Lemberg mentioned.
In a separate message posted on the Open Supply Safety mailing checklist oss-security, it has come to gentle that a number of Linux distributions are operating an outdated model of the library, thus rendering them vulnerable to the flaw. This consists of –
- AlmaLinux
- Alpine Linux
- Amazon Linux 2
- Debian secure / Devuan
- RHEL / CentOS Stream / Alma Linux / and so on. 8 and 9
- GNU Guix
- Mageia
- OpenMandriva
- openSUSE Leap
- Slackware, and
- Ubuntu 22.04
In gentle of lively exploitation, customers are really useful to replace their cases to the newest model of FreeType (2.13.3) for optimum safety.
