- Facebook warned about a fault in freeType that could be used to perform remote code
- The mistake “may have been exploited in nature,” the company said
- A patch was recently released to tackle the vulnerability
Facebook warns of an out -of -limits Write vulnerability in the Freetype, which can allow threat actors to perform random code (RCE). In a security advice published by the company, it said the vulnerability “may have been exploited in nature.”
Freetype is an open source software library that reproduces fonts. It supports various formats such as threat type, opentype and type1 and is widely used in graphics applications, gaming engines and operating systems to display high quality text.
Larger projects such as Android, Linux, Unreal Engine and Chromeos depend on it for font rendering.
Patching of the error
Vulnerability is traced as CVE-2025-27363 and got a severity of 8.1 (high). It affects the library’s versions 2.13.0 and the elderly.
It can be triggered “when trying to analyze the Font Subglyph structures related to Truetype GX and variable font files,” Facebook explained in the counseling. “The vulnerable code assigns a signed card value to an unsigned long and then adds a static value that causes it to wrap around and assign too small of a pile buffer. The code then writes up to 6 signed long integers outside the bounds relative to this buffer. “
While Facebook was the one who warned about the vulnerability, it is unclear whether it depends on the library and in what capacity. It also said that the vulnerability “may have been exploited in nature”, but did not elaborate if it saw the attacks on its own platform or elsewhere.
To tackle the problem, software developers need to upgrade their free type to the latest version (2.13.3) as soon as possible. The first pure version is 2.13.1, although the Freetype Web site does not mention anything about a security upgrade.
“This is a maintenance release with only minor changes,” it was said on the update page.
Via Bleeping computer
