A serious security vulnerability in the widely-used FreeType font rendering library has been identified, with Facebook warning that attackers are actively exploiting the flaw. The vulnerability, tracked as CVE-2025-27363 with a high severity score of 8.1, affects all versions of FreeType up to 2.13.

## What is FreeType?

FreeType is an open-source library used to display and manipulate text across numerous platforms and applications. It’s embedded in millions of systems including:
– Linux distributions
– Android devices
– Game engines
– GUI frameworks
– Various online platforms

## The Vulnerability

The security flaw involves an out-of-bounds write vulnerability when parsing font subglyph structures in TrueType GX and variable font files. The issue stems from a coding error where a signed short value is assigned to an unsigned long and then modified, causing memory allocation problems that can lead to arbitrary code execution.

Although the vulnerability was fixed in FreeType version 2.13.0 released on February 9, 2023, Facebook reports that attacks exploiting this flaw are occurring in the wild.

## Urgent Action Required

Despite the fix being available for two years, older library versions often persist in software projects for extended periods. Security experts strongly recommend that developers and system administrators upgrade to FreeType 2.13.3 (the latest version) immediately.

When contacted by BleepingComputer, Facebook stated: “We report security bugs in open source software when we find them because it strengthens online security for everyone. We think users expect us to keep working on ways to improve security. We remain vigilant and committed to protecting people’s private communications.”