Critical Out of Bounds Write Vulnerability in FreeType Package
Summary
CVE-2025-27363: An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. Affects freetype across 2 version ranges.
< 2.13.1-r0
< de8b92dd7ec634e9e2b25ef534c54a3537555c11
Fixed in 2.13.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeType is a widely-used software library designed to render fonts, supporting various font formats including TrueType and OpenType. It is an essential component in many applications and systems, providing high-quality text rendering capabilities. However, certain versions of FreeType, specifically 2.13.0 and below, are vulnerable to a critical out of bounds write issue that can lead to severe security risks.
Vulnerability Detail
An out of bounds write vulnerability exists in FreeType versions 2.13.0 and below when parsing font subglyph structures related to TrueType GX and variable font files. The vulnerability arises from the assignment of a signed short value to an unsigned long, which causes a wrap-around effect, leading to the allocation of an insufficient heap buffer. This flaw allows for writing up to 6 signed long integers out of bounds, potentially resulting in arbitrary code execution. The vulnerability may have been exploited in the wild, posing a significant risk to systems using affected versions of FreeType.
How To Fix
Minimum fixed version
2.13.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade freetypeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using TrueType GX and variable font files until the package is updated. This may reduce the risk of exploitation until a permanent fix is applied.
Conclusion
The CVE-2025-27363 vulnerability in FreeType poses a significant security risk due to its potential for arbitrary code execution. Users are strongly advised to update to a patched version of FreeType to mitigate this risk. In the meantime, avoiding the use of certain font files can serve as a temporary workaround.
See every vulnerability recorded for freetype →
FAQ
The vulnerability can lead to arbitrary code execution, allowing attackers to potentially take control of affected systems.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
FreeType versions 2.13.0 and below are affected by this out of bounds write vulnerability.
Yes, a patched version of FreeType is available. Users should update to a version greater than 2.13.0.
As a temporary measure, avoid using TrueType GX and variable font files until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for freetype.
