CVE-2025-27363

FreeType Out-of-Bounds Write Vulnerability

n/a

CVSS

26.0%

EPSS (exploit prob.)

97.8%

EPSS percentile

Yes

Actively exploited

Ransomware use

2025-05-06

Added

MITRE ATT&CK techniques

How this vulnerability maps to adversary behaviour, from the Center for Threat-Informed Defense's public CVE→ATT&CK mappings. Use it to check whether your detections already cover the technique.

Technique	Name	Relationship
T1204.002	Malicious File	exploitation technique
T1574	Hijack Execution Flow	primary impact
T1499.004	Application or System Exploitation	secondary impact

Summary

FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.

Affected software

Vendor: FreeType · Product: FreeType

Weakness types (CWE):

What to do

This vulnerability appears in CISA's Known Exploited Vulnerabilities catalog, meaning it is being exploited in the wild. Prioritize patching affected systems and verify exposure across your estate.

Is your domain exposed?

Run a free, instant security report for any domain — exposure score, email auth, TLS and breach metadata.

Get your free report

All information is aggregated from public sources for awareness only and does not constitute an accusation or a security assessment. No personal data or credentials are published.