Is CVE-2025-27363 (FreeType Out-of-Bounds Write) being exploited in the wild?

Yes. CISA added CVE-2025-27363 to its Known Exploited Vulnerabilities catalogue on 6 May 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.

What the exploitation signal means for FreeType users

CVE-2025-27363 is not just a theoretical parsing bug. The KEV listing means defenders should treat it as an active exploitation issue, not a routine vulnerability-management queue item. For font-processing components, that changes the question from “is it vulnerable?” to “where is the parser deployed, and can an attacker influence the font content reaching it?”

FreeType is often embedded deep inside desktop software, document viewers, web stacks, graphics pipelines, and rendering services, so exposure may be broader than a single package inventory suggests. If a system accepts TrueType GX or variable font content from untrusted sources, the attack surface is real even when the application itself is not obviously font-centric.

For a practical baseline on triage and escalation, use the Zero-Day and Exploited Vulnerabilities Guide to align KEV status, urgency, and post-patch validation with the rest of your response process.

Why the out-of-bounds write matters operationally

An out-of-bounds write in a parser is dangerous because it can corrupt adjacent memory while processing crafted input. In a graphics library, that means a malicious font file may do more than crash an application. Depending on how the library is built and where it runs, the flaw may be a path to arbitrary code execution, process takeover, or a broader compromise of the host application.

The security issue is not limited to obvious file upload flows. Rendering libraries can be reached through previews, image generation, report generation, browser components, and document conversion services. That is why you should inventory not only the FreeType package, but also the products that statically bundle it or call it indirectly through other libraries.

If you need a root-cause view of memory-safety weakness classes behind this issue, the CWE Top 25 Guide is the best place to connect the flaw type to the broader prevention picture.

What to do while patching is being scheduled

If you cannot patch immediately, reduce exposure by limiting who can submit or influence font content, removing unnecessary font-processing features, and isolating the most exposed rendering workloads. The practical objective is to stop untrusted font data from reaching the vulnerable parser until the fix is in place.

It is also worth checking whether your environment uses virtualized rendering, conversion workers, or shared service tiers where one vulnerable component can affect multiple products. In those cases, a compensating control at the platform layer may buy time, but it should not be treated as a permanent substitute for remediation.

For prioritisation and follow-up checks, the Vulnerability Management Guide is useful for framing exposure, exception handling, verification, and remediation tracking.

Risk and Threat Considerations

Actively exploited parser bugs create a narrow window where untrusted content becomes an intrusion path. In this case, the attacker only needs a way to deliver or trigger the crafted font structure, which makes document workflows, preview services, and content-processing back ends especially sensitive.

Failure mechanism: A crafted font subglyph structure can drive the parser past buffer bounds, corrupting memory during input handling and potentially turning a file-processing task into code execution.

Impact: The immediate impact can range from process crashes to arbitrary code execution in the rendering context, with the downstream risk depending on whether the affected process holds data access, network reach, or elevated privilege.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8, OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events	Active exploitation makes monitoring for suspicious parsing activity materially relevant.
Recommendation — Monitor exposed font-processing services for anomalous crashes and exploit-like input patterns.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	The question is about an actively exploited vulnerability requiring prioritization and remediation.
Recommendation — Prioritize and remediate KEV-listed exposures before routine backlog items.
OWASP ASVS	V5 — File Handling	The flaw is triggered by parsing crafted font files, a file-handling security concern.
Recommendation — Validate and sandbox file parsing paths that accept untrusted font content.
MITRE ATT&CK	T1203 — Exploitation for Client Execution	A crafted file can trigger code execution through a vulnerable parser.
Recommendation — Map the parser bug to file-based execution paths and hunt for exploit delivery.
NIST SP 800-53 Rev 5	SI-10 — Information Input Validation	The vulnerability arises from unsafe handling of structured input during parsing.
Recommendation — Enforce strict input validation on all font-parsing code paths.

Practitioner Guidance

What to verify: Confirm whether FreeType is present in exposed applications, libraries, containers, or appliance images, and whether those paths accept externally supplied font content. The most important check is not package presence alone, but reachable parsing of untrusted fonts.

Decision rule: If the affected component is internet-facing, user-facing, or reachable through uploaded or embedded content, treat remediation as urgent and assess for compromise before assuming the issue is contained. If patching is delayed, isolate the service and reduce the input surface first.

Practitioner takeaway: For KEV-listed parser vulnerabilities, exposure and reachability matter more than raw inventory, because a single parsing path can be the real exploitation boundary.