Is CVE-2025-27363 actively exploited?

Yes. CVE-2025-27363 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2025-27363 be exploited remotely?

The attack vector of CVE-2025-27363 has not been classified yet.

What is the CVSS score of CVE-2025-27363?

CVE-2025-27363 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2025-27363

HIGHCISA KEVIN THE WILD

CVE-2025-27363

Published: May 6, 2025

EPSS:76.15%probability of exploitation in 30 daysPercentile:98.9th

Official Description

FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.

NVD Source

CISA KEV Advisory

FreeType Out-of-Bounds Write Vulnerability

FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.

Added to KEV: 2025-05-06Federal patch deadline: 2025-05-27

Required Action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Risk Analysis

FreeType contains an out-of-bounds write vulnerability when parsing font subglyph structures, which could lead to arbitrary code execution. The high EPSS score of 0.76154 suggests a strong likelihood of exploitation, and its presence in CISA's KEV confirms that this flaw is actively being exploited.

This vulnerability is actively being exploited in the wild, as confirmed by its inclusion in CISA's KEV.

Recommended Action

Update FreeType to a patched version to mitigate the risk of arbitrary code execution. Ensure all systems using FreeType are kept current with security updates.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-27363 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2025-27363 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.