CVE catalog

CVE-2025-27363

freetype: CVE-2025-27363

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
Exploitation
CISA Known Exploited Vulnerabilities
EPSS
27.77% · Oct 25, 2026

FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianfreetypesid2.14.3+dfsg-3fixed
Debianfreetypeforky2.14.3+dfsg-3fixed
Debianfreetypetrixie2.13.3+dfsg-1+deb13u1fixed
Debianfreetypetrixie-security2.13.3+dfsg-1+deb13u1fixed
Debianfreetypebookworm2.12.1+dfsg-5+deb12u4fixed
Debianfreetypebookworm-security2.12.1+dfsg-5+deb12u4fixed
Androidplatform/external/freetypeNot reported14vulnerable
Androidplatform/external/freetypeNot reported14:2025-05-01fixed
Alpinefreetype3.222.13.1-r0fixed
Alpinefreetype3.232.13.1-r0fixed
Alpinefreetype3.242.13.1-r0fixed
Ubuntufreetypepro2.8-0.2ubuntu2vulnerable
Ubuntufreetypepro2.8.1-0.1ubuntu2vulnerable
Ubuntufreetypepro2.8.1-0.1ubuntu3vulnerable
Ubuntufreetypepro2.8.1-2ubuntu1vulnerable
Ubuntufreetypepro2.8.1-2ubuntu2vulnerable
Ubuntufreetypepro2.8.1-2ubuntu2.1vulnerable
Ubuntufreetypepro2.8.1-2ubuntu2.2vulnerable
Ubuntufreetypepro2.8.1-2ubuntu2.2+esm1fixed
Ubuntufreetype20.042.9.1-4vulnerable
Ubuntufreetype20.042.10.1-2vulnerable
Ubuntufreetype20.042.10.1-2ubuntu0.1vulnerable
Ubuntufreetype20.042.10.1-2ubuntu0.2vulnerable
Ubuntufreetype20.042.10.1-2ubuntu0.3vulnerable
Ubuntufreetype20.042.10.1-2ubuntu0.4fixed
Ubuntufreetype22.042.10.4+dfsg-1build1vulnerable
Ubuntufreetype22.042.10.4+dfsg-1build2vulnerable
Ubuntufreetype22.042.11.0+dfsg-1vulnerable
Ubuntufreetype22.042.11.1+dfsg-1vulnerable
Ubuntufreetype22.042.11.1+dfsg-1build1vulnerable
Ubuntufreetype22.042.11.1+dfsg-1ubuntu0.1vulnerable
Ubuntufreetype22.042.11.1+dfsg-1ubuntu0.2vulnerable
Ubuntufreetype22.042.11.1+dfsg-1ubuntu0.3fixed
Ubuntufreetype20.042.9.1-4vulnerable
Ubuntufreetype20.042.10.1-2vulnerable
Ubuntufreetype20.042.10.1-2ubuntu0.1vulnerable
Ubuntufreetype20.042.10.1-2ubuntu0.2vulnerable
Ubuntufreetype20.042.10.1-2ubuntu0.3vulnerable
Ubuntufreetype20.042.10.1-2ubuntu0.4fixed
Ubuntufreetype22.042.10.4+dfsg-1build1vulnerable
Ubuntufreetype22.042.10.4+dfsg-1build2vulnerable
Ubuntufreetype22.042.11.0+dfsg-1vulnerable
Ubuntufreetype22.042.11.1+dfsg-1vulnerable
Ubuntufreetype22.042.11.1+dfsg-1build1vulnerable
Ubuntufreetype22.042.11.1+dfsg-1ubuntu0.1vulnerable
Ubuntufreetype22.042.11.1+dfsg-1ubuntu0.2vulnerable
Ubuntufreetype22.042.11.1+dfsg-1ubuntu0.3fixed
Susefreetype2linux enterprise micro 5.32.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise micro 5.42.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise micro 5.52.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise module for basesystem 15 sp62.10.4-150000.4.18.1fixed
Suseft2demoslinux enterprise module for desktop applications 15 sp62.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise high performance computing 15 sp3-ltss2.10.4-150000.4.18.1fixed
Suseft2demoslinux enterprise high performance computing 15 sp3-ltss2.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise high performance computing 15 sp4-espos2.10.4-150000.4.18.1fixed
Suseft2demoslinux enterprise high performance computing 15 sp4-espos2.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise high performance computing 15 sp4-ltss2.10.4-150000.4.18.1fixed
Suseft2demoslinux enterprise high performance computing 15 sp4-ltss2.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise high performance computing 15 sp5-espos2.10.4-150000.4.18.1fixed
Suseft2demoslinux enterprise high performance computing 15 sp5-espos2.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise high performance computing 15 sp5-ltss2.10.4-150000.4.18.1fixed
Suseft2demoslinux enterprise high performance computing 15 sp5-ltss2.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise server 15 sp3-ltss2.10.4-150000.4.18.1fixed
Suseft2demoslinux enterprise server 15 sp3-ltss2.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise server 15 sp4-ltss2.10.4-150000.4.18.1fixed
Suseft2demoslinux enterprise server 15 sp4-ltss2.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise server 15 sp5-ltss2.10.4-150000.4.18.1fixed
Suseft2demoslinux enterprise server 15 sp5-ltss2.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise server for sap applications 15 sp32.10.4-150000.4.18.1fixed
Suseft2demoslinux enterprise server for sap applications 15 sp32.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise server for sap applications 15 sp42.10.4-150000.4.18.1fixed
Suseft2demoslinux enterprise server for sap applications 15 sp42.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise server for sap applications 15 sp52.10.4-150000.4.18.1fixed
Suseft2demoslinux enterprise server for sap applications 15 sp52.10.4-150000.4.18.1fixed
Susefreetype2manager proxy 4.32.10.4-150000.4.18.1fixed
Susefreetype2manager server 4.32.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise micro 5.12.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise micro 5.22.10.4-150000.4.18.1fixed
Susefreetype2enterprise storage 7.12.10.4-150000.4.18.1fixed
Suseft2demosenterprise storage 7.12.10.4-150000.4.18.1fixed
Opensusefreetype2leap 15.62.10.4-150000.4.18.1fixed
Opensuseft2demosleap 15.62.10.4-150000.4.18.1fixed
Susefreetype2linux enterprise server 12 sp5-ltss2.6.3-7.21.1fixed
Suseft2demoslinux enterprise server 12 sp5-ltss2.6.3-7.21.1fixed
Susefreetype2linux enterprise server ltss extended security 12 sp52.6.3-7.21.1fixed
Suseft2demoslinux enterprise server ltss extended security 12 sp52.6.3-7.21.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianfreetypesourcesid2.13.1+dfsg-1not yet assignedNot reportedNot reported
Debianfreetypesourceforky2.13.1+dfsg-1not yet assignedNot reportedNot reported
Debianfreetypesourcetrixie2.13.1+dfsg-1not yet assignedNot reportedNot reported
Debianfreetypesourcebookworm2.12.1+dfsg-5+deb12u4not yet assignedNot reportedNot reported
Androidplatform/external/freetypeAndroidNot reported14:2025-05-01Not reportedASB-A-399065987Not reported
Alpinefreetypeapk3.222.13.1-r0Not reportedALPINE-CVE-2025-27363Not reported
Alpinefreetypeapk3.232.13.1-r0Not reportedALPINE-CVE-2025-27363Not reported
Alpinefreetypeapk3.242.13.1-r0Not reportedALPINE-CVE-2025-27363Not reported
Ubuntufreetypedebpro2.8.1-2ubuntu2.2+esm1Not reportedUBUNTU-CVE-2025-27363Not reported
Ubuntufreetypedeb20.042.10.1-2ubuntu0.4Not reportedUBUNTU-CVE-2025-27363Not reported
Ubuntufreetypedeb22.042.11.1+dfsg-1ubuntu0.3Not reportedUBUNTU-CVE-2025-27363Not reported
Ubuntufreetypedeb20.042.10.1-2ubuntu0.4Not reportedUSN-7352-1Not reported
Ubuntufreetypedeb22.042.11.1+dfsg-1ubuntu0.3Not reportedUSN-7352-1Not reported
Susefreetype2rpmlinux enterprise micro 5.32.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise micro 5.42.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise micro 5.52.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise module for basesystem 15 sp62.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmlinux enterprise module for desktop applications 15 sp62.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise high performance computing 15 sp3-ltss2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmlinux enterprise high performance computing 15 sp3-ltss2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise high performance computing 15 sp4-espos2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmlinux enterprise high performance computing 15 sp4-espos2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise high performance computing 15 sp4-ltss2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmlinux enterprise high performance computing 15 sp4-ltss2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise high performance computing 15 sp5-espos2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmlinux enterprise high performance computing 15 sp5-espos2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise high performance computing 15 sp5-ltss2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmlinux enterprise high performance computing 15 sp5-ltss2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise server 15 sp3-ltss2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmlinux enterprise server 15 sp3-ltss2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise server 15 sp4-ltss2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmlinux enterprise server 15 sp4-ltss2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise server 15 sp5-ltss2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmlinux enterprise server 15 sp5-ltss2.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise server for sap applications 15 sp32.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmlinux enterprise server for sap applications 15 sp32.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise server for sap applications 15 sp42.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmlinux enterprise server for sap applications 15 sp42.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise server for sap applications 15 sp52.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmlinux enterprise server for sap applications 15 sp52.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmmanager proxy 4.32.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmmanager server 4.32.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise micro 5.12.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise micro 5.22.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmenterprise storage 7.12.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Suseft2demosrpmenterprise storage 7.12.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Opensusefreetype2rpmleap 15.62.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Opensuseft2demosrpmleap 15.62.10.4-150000.4.18.1Not reportedSUSE-SU-2025:0998-1Not reported
Susefreetype2rpmlinux enterprise server 12 sp5-ltss2.6.3-7.21.1Not reportedSUSE-SU-2025:0960-1Not reported
Suseft2demosrpmlinux enterprise server 12 sp5-ltss2.6.3-7.21.1Not reportedSUSE-SU-2025:0960-1Not reported
Susefreetype2rpmlinux enterprise server ltss extended security 12 sp52.6.3-7.21.1Not reportedSUSE-SU-2025:0960-1Not reported
Suseft2demosrpmlinux enterprise server ltss extended security 12 sp52.6.3-7.21.1Not reportedSUSE-SU-2025:0960-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [freetype]

    Details (4)
    • 2.12.1+dfsg-5+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

  • Source package: [freetype]

    Details (4)
    • 2.12.1+dfsg-5+deb12u4 · all · bookworm

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · all · bookworm

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

  • Source package: [freetype]

    Details (4)
    • 2.12.1+dfsg-5+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

  • Source package: [freetype]

    Details (4)
    • 2.12.1+dfsg-5+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

  • Source package: [freetype]

    Details (4)
    • 2.12.1+dfsg-5+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

    • 2.12.1+dfsg-5+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.12.1+dfsg-5+deb12u4

      dsa · freetype · debian · bookworm; dsa · freetype · debian · 12

[Debian 13 (Trixie)]

  • Source package: [freetype]

    Details (4)
    • 2.13.3+dfsg-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

    • 2.13.3+dfsg-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

    • 2.13.3+dfsg-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

    • 2.13.3+dfsg-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

  • Source package: [freetype]

    Details (4)
    • 2.13.3+dfsg-1+deb13u1 · all · trixie

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

    • 2.13.3+dfsg-1+deb13u1 · all · trixie

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

    • 2.13.3+dfsg-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

    • 2.13.3+dfsg-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

  • Source package: [freetype]

    Details (4)
    • 2.13.3+dfsg-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

    • 2.13.3+dfsg-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

    • 2.13.3+dfsg-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

    • 2.13.3+dfsg-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

  • Source package: [freetype]

    Details (4)
    • 2.13.3+dfsg-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

    • 2.13.3+dfsg-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

    • 2.13.3+dfsg-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

    • 2.13.3+dfsg-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.13.1+dfsg-1

      dsa · freetype · debian · 13

Observed:

References