Read the docs
TI-2025-20210 Aliases CVE-2025-27363GHSA-g8qj-jv5h-78cp

Out-of-bounds write in FreeType

Priority CRITICAL 94Exploited in the wildCWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 31 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

Why it matters now

Exploitation Active In CISA KEV since 2025-05-06CISA due date 2025-05-27
EPSS 0.27775 98th percentileScored 2026-11-07
Fix Partial Red Hat: 17 advisoriesRed Hat: 31 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FreeTypeFreeType0.0.0 – 2.13.0—No fix listedCNA
  • FreeType VendorFreeType Affected 0.0.0 – 2.13.0 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*up to 2.13.0VulnerableFreeType
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:* Versions up to 2.13.0 Vulnerable ·FreeType
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

Red Hat 17 advisories

  • RHSA-2025:9380 Released 2025-06-23 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) spice-client-win-8.2-1.el8_2, spice-client-win-x64-8.2-1.el8_2, spice-client-win-x86-8.2-1.el8_2
  • RHSA-2025:8292 Released 2025-05-29 · Red Hat rating Important
    mingw-freetype and spice-client-win security update
    • Red Hat Enterprise Linux AppStream (v. 8) spice-client-win-8.10-1.el8_10, spice-client-win-x64-8.10-1.el8_10, spice-client-win-x86-8.10-1.el8_10
    • Red Hat Enterprise Linux CRB (v. 8) mingw-freetype-2.8-3.el8_10.1, mingw32-freetype-2.8-3.el8_10.1, mingw32-freetype-static-2.8-3.el8_10.1 +2
  • RHSA-2025:8253 Released 2025-05-28 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) spice-client-win-8.4-2.el8_4, spice-client-win-x64-8.4-2.el8_4, spice-client-win-x86-8.4-2.el8_4
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) spice-client-win-8.4-2.el8_4, spice-client-win-x64-8.4-2.el8_4, spice-client-win-x86-8.4-2.el8_4
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) spice-client-win-8.4-2.el8_4, spice-client-win-x64-8.4-2.el8_4, spice-client-win-x86-8.4-2.el8_4
Show 14 more Red Hat advisories
  • RHSA-2025:8219 Released 2025-05-27 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) spice-client-win-8.6-1.el8_6, spice-client-win-x64-8.6-1.el8_6, spice-client-win-x86-8.6-1.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) spice-client-win-8.6-1.el8_6, spice-client-win-x64-8.6-1.el8_6, spice-client-win-x86-8.6-1.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) spice-client-win-8.6-1.el8_6, spice-client-win-x64-8.6-1.el8_6, spice-client-win-x86-8.6-1.el8_6
  • RHSA-2025:8195 Released 2025-05-27 · Red Hat rating Important
    mingw-freetype and spice-client-win security update
    • Red Hat CodeReady Linux Builder EUS (v.8.8) mingw-freetype-2.8-3.el8_8.1, mingw32-freetype-2.8-3.el8_8.1, mingw32-freetype-static-2.8-3.el8_8.1 +2
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) spice-client-win-8.8-5.el8_8, spice-client-win-x64-8.8-5.el8_8, spice-client-win-x86-8.8-5.el8_8
  • RHSA-2025:4409 Released 2025-05-08 · Red Hat rating Important
    OpenShift Container Platform 4.12.76 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-baremetal-rhel8-operator, openshift4/ose-ibm-vpc-block-csi-driver-rhel8 +2
  • RHSA-2025:3573 Released 2025-04-10 · Red Hat rating Important
    OpenShift Container Platform 4.12.75 packages and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/network-tools-rhel8, openshift4/ose-agent-installer-node-agent-rhel8, openshift4/ose-docker-builder +5
  • RHSA-2025:3421 Released 2025-03-31 · Red Hat rating Important
    freetype security update
    • Red Hat Enterprise Linux BaseOS (v. 8) freetype-2.9.1-10.el8_10, freetype-devel-2.9.1-10.el8_10
  • RHSA-2025:3407 Released 2025-03-31 · Red Hat rating Important
    freetype security update
    • Red Hat Enterprise Linux AppStream (v. 9) freetype-2.10.4-10.el9_5, freetype-devel-2.10.4-10.el9_5
    • Red Hat Enterprise Linux BaseOS (v. 9) freetype-2.10.4-10.el9_5
  • RHSA-2025:3395 Released 2025-03-31 · Red Hat rating Important
    freetype security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) freetype-2.8-15.el7_9.1, freetype-2.8-15.el7_9.1.ppc, freetype-devel-2.8-15.el7_9.1 +1
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) freetype-demos-2.8-15.el7_9.1
  • RHSA-2025:3393 Released 2025-03-31 · Red Hat rating Important
    freetype security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) freetype-2.9.1-5.el8_2.1, freetype-devel-2.9.1-5.el8_2.1
  • RHSA-2025:3387 Released 2025-03-31 · Red Hat rating Important
    freetype security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) freetype-2.10.4-7.el9_0, freetype-devel-2.10.4-7.el9_0
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) freetype-2.10.4-7.el9_0
  • RHSA-2025:3383 Released 2025-03-31 · Red Hat rating Important
    freetype security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) freetype-2.10.4-10.el9_4, freetype-devel-2.10.4-10.el9_4
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) freetype-2.10.4-10.el9_4
  • RHSA-2025:3386 Released 2025-03-31 · Red Hat rating Important
    freetype security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) freetype-2.9.1-10.el8_8, freetype-devel-2.9.1-10.el8_8
  • RHSA-2025:3384 Released 2025-03-31 · Red Hat rating Important
    freetype security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) freetype-2.10.4-10.el9_2, freetype-devel-2.10.4-10.el9_2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.2) freetype-2.10.4-10.el9_2
  • RHSA-2025:3385 Released 2025-03-31 · Red Hat rating Important
    freetype security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) freetype-2.9.1-6.el8_6.3, freetype-devel-2.9.1-6.el8_6.3
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) freetype-2.9.1-6.el8_6.3, freetype-devel-2.9.1-6.el8_6.3
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) freetype-2.9.1-6.el8_6.3, freetype-devel-2.9.1-6.el8_6.3
  • RHSA-2025:3382 Released 2025-03-31 · Red Hat rating Important
    freetype security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) freetype-2.9.1-7.el8_4, freetype-devel-2.9.1-7.el8_4
    • Red Hat Enterprise Linux BaseOS E4S (v.8.4) freetype-2.9.1-7.el8_4, freetype-devel-2.9.1-7.el8_4
    • Red Hat Enterprise Linux BaseOS TUS (v.8.4) freetype-2.9.1-7.el8_4, freetype-devel-2.9.1-7.el8_4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder EUS (v.8.8)Fixed RHSA-2025:8195
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:8292
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:3407
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2025:9380
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:8253
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:8219
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2025:8253
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:8219
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:3387
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2025:8195
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2025:3384
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:3383
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2025:8253
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:8219
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:3421
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:3407
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2025:3393
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2025:3382
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2025:3385
Red Hat Enterprise Linux BaseOS E4S (v.8.4)Fixed RHSA-2025:3382
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2025:3385
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2025:3387
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2025:3386
Red Hat Enterprise Linux BaseOS EUS (v.9.2)Fixed RHSA-2025:3384
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2025:3383
Red Hat Enterprise Linux BaseOS TUS (v.8.4)Fixed RHSA-2025:3382
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2025:3385
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2025:8292
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2025:3395
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2025:3395
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2025:3573, RHSA-2025:4409
Not affected: 8 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat build of OpenJDK 11
  • Red Hat build of OpenJDK 17
  • Red Hat build of OpenJDK 21

Timeline

  1. 2025-05-06 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-27363
  3. 2026-10-03 Alias added: GHSA-g8qj-jv5h-78cp
  4. 2026-11-04 Fix available: RHSA-2025:4409 · Red Hat

References

Advisory 2

  • TI-2020-12611 Buffer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2025-16833 FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c. CVSS 3.1MEDIUM 6.2
  • TI-2012-01032 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other… CVSS 2.0HIGH 10.0
  • TI-2011-02548 The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in… CVSS 2.0HIGH 9.3
  • TI-2010-03164 Integer overflow in base/ftstream.c in libXft (aka the X FreeType library) in FreeType… CVSS 2.0HIGH 9.3
  • TI-2017-05683 FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer… CVSS 3.0CRITICAL 9.8
See all 94 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences