VulnRadar

Data against noise.

Built with NaN
Page generated: 10 Nov 2026, 18:08 UTC
← Dashboard

CVE-2025-27363

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned lo…

Read full description
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
CVSS 8.1 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.4/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 8.1: +1.21
  • Fresh EPSS: 27.77%: +0.14

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 11 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

IBM
Press · 17 Mar 2026, 07:00 · Cloud attacks are evolving: What 2025 trends mean for defenders in 2026 - IBM
SecurityWeek
Press · 20 Jun 2025, 07:00 · FreeType Zero-Day Found by Meta Exploited in Paragon Spyware Attacks - SecurityWeek
Help Net Security
Press · 07 May 2025, 07:00 · Actively exploited FreeType flaw fixed in Android (CVE-2025-27363) - Help Net Security
9to5Google
Press · 06 May 2025, 07:00 · Android 15 May update rolling out: Pixel microphone, Bluetooth fixes - 9to5Google
Forbes
Press · 06 May 2025, 07:00 · Critical Android ‘No Interaction’ Attacks Confirmed By Google - Forbes
See all 11 source documents
CyberSecurityNews
Press · 06 May 2025, 07:00 · Android Security Update – Critical Patch Released for Actively Exploited Vulnerability - CyberSecurityNews
GBHackers News
Press · 06 May 2025, 07:00 · Android Security Update -A Critical RCE Vulnerability Actively Exploited in the Wild - GBHackers News
Forbes
Press · 06 May 2025, 07:00 · Google Confirms Android Attacks—Millions Of Samsung Phones Need Update - Forbes
The Hacker News
Press · 13 Mar 2025, 07:00 · Meta Warns of FreeType Vulnerability (CVE-2025-27363) With Active Exploitation Risk - The Hacker News
Field Effect
Press · 13 Mar 2025, 07:00 · Severe flaw found in FreeType library used by millions of systems - Field Effect
The Hacker News
Press · 14 Feb 2025, 08:00 · Microsoft: Russian-Linked Hackers Using 'Device Code Phishing' to Hijack Accounts - The Hacker News

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.4 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 8.1; EPSS 27.8%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction, additional attack conditions.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:32.825259+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
14 Feb 2025, 08:00
Published
11 Mar 2025, 13:28
Added to the CISA KEV catalog
06 May 2025, 00:00
Latest press mention
17 Mar 2026, 07:00
Score calculated
05 Nov 2026, 13:59
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar