Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
FreeType library can write outside memory when handling variable fonts
published 2 months ago
Summary
The FreeType graphics library used for processing fonts may write data beyond its allocated space when it reads certain composite glyphs in variable TrueType fonts. This can lead to crashes or allow an attacker to run unwanted code. Update the FreeType packages (freetype2-demos, libfreetype6, libfreetype6-dev) to the latest version that includes the fix.
What to do
- Update canonical freetype2-demos to version 2.8.1-2ubuntu2.2+tuxcare.els1.
- Update canonical libfreetype6 to version 2.8.1-2ubuntu2.2+tuxcare.els1.
- Update canonical libfreetype6-dev to version 2.8.1-2ubuntu2.2+tuxcare.els1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Ubuntu:18.04 | canonical | freetype2-demos |
< 2.8.1-2ubuntu2.2+tuxcare.els1 Fix: upgrade to 2.8.1-2ubuntu2.2+tuxcare.els1
|
| TuxCare:Ubuntu:18.04 | canonical | libfreetype6 |
< 2.8.1-2ubuntu2.2+tuxcare.els1 Fix: upgrade to 2.8.1-2ubuntu2.2+tuxcare.els1
|
| TuxCare:Ubuntu:18.04 | canonical | libfreetype6-dev |
< 2.8.1-2ubuntu2.2+tuxcare.els1 Fix: upgrade to 2.8.1-2ubuntu2.2+tuxcare.els1
|
Original advisory text
Fix CVE(s): CVE-2025-27363
* SECURITY UPDATE: out-of-bounds write when parsing composite subglyphs
of TrueType GX / variable fonts (ELSCVE-171535)
- debian/patches-freetype/CVE-2025-27363.patch: reject a subglyph count
that truncates to a negative short in load_truetype_glyph before it
is used to size the outline arrays in src/truetype/ttgload.c.
- CVE-2025-27363
of TrueType GX / variable fonts (ELSCVE-171535)
- debian/patches-freetype/CVE-2025-27363.patch: reject a subglyph count
that truncates to a negative short in load_truetype_glyph before it
is used to size the outline arrays in src/truetype/ttgload.c.
- CVE-2025-27363
References
- https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787310855.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-27363 Vendor Advisory
Timeline
Published21 Aug 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1787310855 · OSV
Track software like this
Free during beta