CVE-2025-27363

An out-of-bounds write occurs when FreeType 2.13.0 and earlier parse font subglyph structures in TrueType GX and variable font files. The code mistakenly casts a signed short to an unsigned long, which wraps around and allocates a heap buffer that is too small. Up to six signed long integers are then written beyond the buffer’s end, which may allow an attacker to hijack control flow and, based on the description, potentially lead to arbitrary code execution. This is a classic heap overflow (CWE‑787).

The vulnerability affects FreeType libraries up to and including version 2.13.0. It is bundled with many Linux distributions, including Red Hat Enterprise Linux 8 and 9, Red Hat OpenShift 4.12, and various Red Hat support streams. Any application or service that loads TrueType GX or variable font files via FreeType may be exposed.

With a CVSS score of 8.1 and an EPSS score of 28%, the risk is high. The vulnerability is listed in the CISA KEV catalog, indicating that exploits have been reported in the wild. Based on the description, it is inferred that attackers could deliver specially crafted font files locally or remotely to any application that processes them, potentially leading to remote code execution. Based on the description, it is inferred that the likely attack vector is the input of manipulated font files to a vulnerable process.