CVE-2025-66034

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2.

• CWE-91

• https://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32Patch
• https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fvExploit, Vendor Advisory
• https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fvExploit, Vendor Advisory

Published

Nov 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66029Open OnDemand provides remote web access to supercomputers. …7.6
• CVE-2025-6603A vulnerability was found in coldfunction qCUDA up to db0085…5.3
• CVE-2025-66030Forge (also called `node-forge`) is a native implementation …5.3
• CVE-2025-66031Forge (also called `node-forge`) is a native implementation …7.5
• CVE-2025-66032Claude Code is an agentic coding tool. Prior to 1.0.93, Due …9.8
• CVE-2025-66033Okta Java Management SDK facilitates interactions with the O…5.3
• CVE-2025-66035Angular is a development platform for building mobile and de…7.7
• CVE-2025-66036Retro is an online platform providing items of vintage colle…6.1
• CVE-2025-66037OpenSC is an open source smart card tools and middleware. Pr…6.8
• CVE-2025-66038OpenSC is an open source smart card tools and middleware. Pr…6.8
• CVE-2025-66039FreePBX Endpoint Manager is a module for managing telephony …9.8
• CVE-2025-6604A vulnerability classified as critical has been found in Sou…8.8