Meta Warns of FreeType Vulnerability Exploited in Wild to Execute Arbitrary Code
- С сайта: Vulnerability(cybersecuritynews.com)
- Вернуться к списку новостей
С сайта: Vulnerability(cybersecuritynews.com)
A critical vulnerability in the widely used FreeType font rendering library has been discovered and is reportedly being exploited in the wild, posing a serious security threat to millions of devices across multiple platforms.
Security researchers have identified the flaw, tracked as CVE-2025-27363, which carries a high severity CVSS score of 8.1 and affects FreeType versions 2.13.0 and below.
FreeType Vulnerability – CVE-2025-27363
According to Facebook reports, the vulnerability is classified as an out-of-bounds write flaw that occurs when parsing font subglyph structures related to TrueType GX and variable font files.
The vulnerable code assigns a signed short value to an unsigned long and then adds a static value, causing it to wrap around and allocate too small of a heap buffer.
This buffer allocation error subsequently enables the writing of up to six signed long integers outside the bounds of the allocated memory space.
The technical consequence of this memory corruption is severe, as it may enable arbitrary code execution, potentially giving attackers complete control over affected systems.
FreeType’s ubiquitous nature in the software ecosystem makes this vulnerability particularly concerning.
The library is integrated into numerous operating systems, including GNU/Linux, FreeBSD, NetBSD, ChromeOS, and ReactOS.
Mobile platforms are not spared either, with Android, Tizen, and iOS all potentially vulnerable.
Additionally, software components such as Ghostscript and popular browser engines including Chromium, WebKit, Gecko, and Goanna incorporate the FreeType library.
Many Linux distributions are running outdated versions of the library, making them susceptible to exploitation.
These include AlmaLinux, Alpine Linux, Amazon Linux 2, Debian stable, RHEL/CentOS Stream 8 and 9, GNU Guix, Mageia, OpenMandriva, openSUSE Leap, Slackware, and Ubuntu 22.04.
Risk Factors Details Affected ProductsFreeType versions 0.0.0 through 2.13.0
Operating Systems: GNU/Linux, FreeBSD, NetBSD, ChromeOS, ReactOS Mobile Platforms: Android, Tizen, iOS Software: Ghostscript Browser Engines: Chromium, WebKit, Gecko, Goanna Linux Distributions: AlmaLinux, Alpine Linux, Amazon Linux 2, Debian stable, RHEL/CentOS Stream 8 and 9, GNU Guix, Mageia, OpenMandriva, openSUSE Leap, Slackware, Ubuntu 22.04ImpactArbitrary code execution, Complete system compromise, Memory corruptionExploit PrerequisitesProcessing of specially crafted TrueType GX or variable font filesUser interaction to open malicious font or document containing exploit No authentication required for exploitationCVSS 3.1 Score8.1 (High)
Security researchers, including those at Meta, have reported that CVE-2025-27363 may have already been exploited in active attacks.
While specific details about the nature and scope of these exploits remain limited, the warning suggests that threat actors are aware of and leveraging this vulnerability to compromise systems.
This is not the first time FreeType has experienced severe security issues. In 2020, a similar vulnerability (CVE-2020-15999) was discovered in the FreeType function “Load_SBit_Png,” which processed PNG images embedded into fonts.
That vulnerability was actively exploited to target Google Chrome users and required an emergency patch.
Mitigations
Security experts strongly recommend updating to FreeType version 2.13.3, which is not affected by this vulnerability.
For systems running older versions, immediate patching is critical. According to FreeType developer Werner Lemberg, a fix for the vulnerability has been incorporated for almost two years, and “FreeType versions larger than 2.13.0 are no longer affected”.
Organizations are advised to prioritize these updates, especially for internet-facing systems or those processing font files from untrusted sources.
Additional security measures, such as implementing network segmentation and enhanced monitoring for suspicious font file processing activities, are also recommended to minimize exposure to this critical vulnerability.
#Cyber_Security #Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news
Оригинальная версия на сайте:
Meta Warns of FreeType Vulnerability Exploited in Wild to Execute Arbitrary Code
Author: KaaviyaA critical vulnerability in the widely used FreeType font rendering library has been discovered and is reportedly being exploited in the wild, posing a serious security threat to millions of devices across multiple platforms.
Security researchers have identified the flaw, tracked as CVE-2025-27363, which carries a high severity CVSS score of 8.1 and affects FreeType versions 2.13.0 and below.
FreeType Vulnerability – CVE-2025-27363
According to Facebook reports, the vulnerability is classified as an out-of-bounds write flaw that occurs when parsing font subglyph structures related to TrueType GX and variable font files.
The vulnerable code assigns a signed short value to an unsigned long and then adds a static value, causing it to wrap around and allocate too small of a heap buffer.
This buffer allocation error subsequently enables the writing of up to six signed long integers outside the bounds of the allocated memory space.
The technical consequence of this memory corruption is severe, as it may enable arbitrary code execution, potentially giving attackers complete control over affected systems.
FreeType’s ubiquitous nature in the software ecosystem makes this vulnerability particularly concerning.
The library is integrated into numerous operating systems, including GNU/Linux, FreeBSD, NetBSD, ChromeOS, and ReactOS.
Mobile platforms are not spared either, with Android, Tizen, and iOS all potentially vulnerable.
Additionally, software components such as Ghostscript and popular browser engines including Chromium, WebKit, Gecko, and Goanna incorporate the FreeType library.
Many Linux distributions are running outdated versions of the library, making them susceptible to exploitation.
These include AlmaLinux, Alpine Linux, Amazon Linux 2, Debian stable, RHEL/CentOS Stream 8 and 9, GNU Guix, Mageia, OpenMandriva, openSUSE Leap, Slackware, and Ubuntu 22.04.
Risk Factors Details Affected ProductsFreeType versions 0.0.0 through 2.13.0
Operating Systems: GNU/Linux, FreeBSD, NetBSD, ChromeOS, ReactOS Mobile Platforms: Android, Tizen, iOS Software: Ghostscript Browser Engines: Chromium, WebKit, Gecko, Goanna Linux Distributions: AlmaLinux, Alpine Linux, Amazon Linux 2, Debian stable, RHEL/CentOS Stream 8 and 9, GNU Guix, Mageia, OpenMandriva, openSUSE Leap, Slackware, Ubuntu 22.04ImpactArbitrary code execution, Complete system compromise, Memory corruptionExploit PrerequisitesProcessing of specially crafted TrueType GX or variable font filesUser interaction to open malicious font or document containing exploit No authentication required for exploitationCVSS 3.1 Score8.1 (High)
Security researchers, including those at Meta, have reported that CVE-2025-27363 may have already been exploited in active attacks.
While specific details about the nature and scope of these exploits remain limited, the warning suggests that threat actors are aware of and leveraging this vulnerability to compromise systems.
This is not the first time FreeType has experienced severe security issues. In 2020, a similar vulnerability (CVE-2020-15999) was discovered in the FreeType function “Load_SBit_Png,” which processed PNG images embedded into fonts.
That vulnerability was actively exploited to target Google Chrome users and required an emergency patch.
Mitigations
Security experts strongly recommend updating to FreeType version 2.13.3, which is not affected by this vulnerability.
For systems running older versions, immediate patching is critical. According to FreeType developer Werner Lemberg, a fix for the vulnerability has been incorporated for almost two years, and “FreeType versions larger than 2.13.0 are no longer affected”.
Organizations are advised to prioritize these updates, especially for internet-facing systems or those processing font files from untrusted sources.
Additional security measures, such as implementing network segmentation and enhanced monitoring for suspicious font file processing activities, are also recommended to minimize exposure to this critical vulnerability.
#Cyber_Security #Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news
Оригинальная версия на сайте:
