CVE-2025-27363 FreeType Out-of-Bounds Write

Exploited in the wild High 8.1 Published 11 Mar 2025 Updated 19 Apr 2026

Out-of-bounds write in FreeType allows arbitrary code execution via malicious TrueType GX or variable font files.

Exploited in the wild: Since 6 May 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-27363?

CVE-2025-27363 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 11 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

Weakness: CWE-787

Which versions are affected by CVE-2025-27363?

It affects 2 products.

Linux distribution packages (40)

`freetype` AlmaLinux:8	All versions	`2.9.1-10.el8_10`
`freetype-devel` AlmaLinux:8	All versions	`2.9.1-10.el8_10`
`freetype` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.9.1-10.el8_10`
`freetype-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.9.1-10.el8_10`
`freetype-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.9.1-10.el8_10`
`freetype-demos-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.9.1-10.el8_10`
`freetype-devel` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.9.1-10.el8_10`
`freetype` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.10.4-10.el9_5`
`freetype-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.10.4-10.el9_5`
`freetype-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.10.4-10.el9_5`
`freetype-demos-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.10.4-10.el9_5`
`freetype-devel` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.10.4-10.el9_5`
`freetype` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.10.4-10.el9_5`
`freetype-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.10.4-10.el9_5`
`freetype-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.10.4-10.el9_5`
`freetype-demos-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.10.4-10.el9_5`
`spice-client-win` Red Hat:rhel_aus:8.2::appstream	All versions	`0:8.2-1.el8_2`
`spice-client-win-x64` Red Hat:rhel_aus:8.2::appstream	All versions	`0:8.2-1.el8_2`
`spice-client-win-x86` Red Hat:rhel_aus:8.2::appstream	All versions	`0:8.2-1.el8_2`
`freetype` Red Hat:rhel_aus:8.2::baseos	All versions	`0:2.9.1-5.el8_2.1`
`freetype-debuginfo` Red Hat:rhel_aus:8.2::baseos	All versions	`0:2.9.1-5.el8_2.1`
`freetype-debugsource` Red Hat:rhel_aus:8.2::baseos	All versions	`0:2.9.1-5.el8_2.1`
`freetype-demos-debuginfo` Red Hat:rhel_aus:8.2::baseos	All versions	`0:2.9.1-5.el8_2.1`
`freetype-devel` Red Hat:rhel_aus:8.2::baseos	All versions	`0:2.9.1-5.el8_2.1`
`spice-client-win` Red Hat:rhel_aus:8.4::appstream	All versions	`0:8.4-2.el8_4`
`spice-client-win-x64` Red Hat:rhel_aus:8.4::appstream	All versions	`0:8.4-2.el8_4`
`spice-client-win-x86` Red Hat:rhel_aus:8.4::appstream	All versions	`0:8.4-2.el8_4`
`freetype` Red Hat:rhel_aus:8.4::baseos	All versions	`0:2.9.1-7.el8_4`
`freetype-debuginfo` Red Hat:rhel_aus:8.4::baseos	All versions	`0:2.9.1-7.el8_4`
`freetype-debugsource` Red Hat:rhel_aus:8.4::baseos	All versions	`0:2.9.1-7.el8_4`
`freetype-demos-debuginfo` Red Hat:rhel_aus:8.4::baseos	All versions	`0:2.9.1-7.el8_4`
`freetype-devel` Red Hat:rhel_aus:8.4::baseos	All versions	`0:2.9.1-7.el8_4`
`spice-client-win` Red Hat:rhel_aus:8.6::appstream	All versions	`0:8.6-1.el8_6`
`spice-client-win-x64` Red Hat:rhel_aus:8.6::appstream	All versions	`0:8.6-1.el8_6`
`spice-client-win-x86` Red Hat:rhel_aus:8.6::appstream	All versions	`0:8.6-1.el8_6`
`freetype` Red Hat:rhel_aus:8.6::baseos	All versions	`0:2.9.1-6.el8_6.3`
`freetype-debuginfo` Red Hat:rhel_aus:8.6::baseos	All versions	`0:2.9.1-6.el8_6.3`
`freetype-debugsource` Red Hat:rhel_aus:8.6::baseos	All versions	`0:2.9.1-6.el8_6.3`
`freetype-demos-debuginfo` Red Hat:rhel_aus:8.6::baseos	All versions	`0:2.9.1-6.el8_6.3`
`freetype-devel` Red Hat:rhel_aus:8.6::baseos	All versions	`0:2.9.1-6.el8_6.3`

Products include Debian Debian Linux, Freetype Freetype.

How do I fix CVE-2025-27363?

Upgrade to a fixed version. US federal agencies must fix it by 27 May 2025.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-27363 being exploited?

Yes. Attackers have exploited CVE-2025-27363 in the wild since at least 6 May 2025.

Public exploit code: 3 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as A-399065987, ALPINE-CVE-2025-27363, ALSA-2025:3421, ASB-A-399065987, AZL-58354, BELL-CVE-2025-27363 and 33 more.