CVE-2025-27363

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

• CWE-787

• https://www.facebook.com/security/advisories/cve-2025-27363Third Party Advisory
• http://www.openwall.com/lists/oss-security/2025/03/13/1Mailing List
• http://www.openwall.com/lists/oss-security/2025/03/13/11Mailing List
• http://www.openwall.com/lists/oss-security/2025/03/13/12Mailing List
• http://www.openwall.com/lists/oss-security/2025/03/13/2Mailing List
• http://www.openwall.com/lists/oss-security/2025/03/13/3Mailing List
• http://www.openwall.com/lists/oss-security/2025/03/13/8Mailing List
• http://www.openwall.com/lists/oss-security/2025/03/14/1Mailing List
• http://www.openwall.com/lists/oss-security/2025/03/14/2Mailing List
• http://www.openwall.com/lists/oss-security/2025/03/14/3Mailing List
• http://www.openwall.com/lists/oss-security/2025/03/14/4Mailing List
• http://www.openwall.com/lists/oss-security/2025/05/06/3Mailing List
• http://www.openwall.com/lists/oss-security/2026/04/16/5Mailing List
• http://www.openwall.com/lists/oss-security/2026/04/19/3Mailing List
• https://lists.debian.org/debian-lts-announce/2025/03/msg00030.htmlMailing List
• https://source.android.com/docs/security/bulletin/2025-05-01Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27363US Government Resource

Published

Mar 11, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27358Improper Neutralization of Script-Related HTML Tags in a Web…4.6
• CVE-2025-27359Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP…4.3
• CVE-2025-2736A vulnerability was found in PHPGurukul Old Age Home Managem…9.8
• CVE-2025-27360Cross-Site Request Forgery (CSRF) vulnerability in WP Corner…4.3
• CVE-2025-27361Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-27362Improper Control of Filename for Include/Require Statement i…8.1
• CVE-2025-27364In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a R…10
• CVE-2025-27365IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0…6.5
• CVE-2025-27367IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to…6.5
• CVE-2025-27368IBM OpenPages 9.0 and 9.1 is vulnerable to information discl…4.3
• CVE-2025-27369IBM OpenPages with Watson 8.3 and 9.0 is vulnerable …4.3
• CVE-2025-2737A vulnerability was found in PHPGurukul Old Age Home Managem…9.8