Fb is warning {that a} FreeType vulnerability in all variations as much as 2.13 can result in arbitrary code execution, with stories that the flaw has been exploited in assaults.
FreeType is a well-liked open-source font rendering library used to show textual content and programmatically add textual content to photographs. It offers performance to load, rasterize, and render fonts in varied codecs, reminiscent of TrueType (TTF), OpenType (OTF), and others.
The library is put in in thousands and thousands of methods and providers, together with Linux, Android, sport engines, GUI frameworks, and on-line platforms.
The vulnerability, tracked underneath CVE-2025-27363 and given a CVSS v3 severity rating of 8.1 (“excessive”), was mounted in FreeType model 2.13.0 on February ninth, 2023.
Fb disclosed the flaw yesterday, warning that the vulnerability is exploitable in all variations of FreeType as much as model 2.13 and that there are stories of it actively being exploited in assaults.
“An out of bounds write exists in FreeType variations 2.13.0 and beneath when trying to parse font subglyph buildings associated to TrueType GX and variable font recordsdata,” reads the bulletin.
“The susceptible code assigns a signed brief worth to an unsigned lengthy after which provides a static worth inflicting it to wrap round and allocate too small of a heap buffer.”
“The code then writes as much as 6 signed lengthy integers out of bounds relative to this buffer. This may occasionally end in arbitrary code execution.”
Fb might depend on FreeType in some capability, however it’s unclear if the assaults seen by its safety workforce came about on its platform or if they found them elsewhere.
Contemplating the widespread use of FreeType throughout a number of platforms, software program builders and mission directors should improve to FreeType 2.13.3 (newest model) as quickly as potential.
Though the newest susceptible model (2.13.0) dates two years, older library variations can persist in software program initiatives for prolonged durations, making it necessary to deal with the flaw as quickly as potential.
BleepingComputer requested Meta concerning the flaw and the way it was exploited, and was despatched the next assertion.
“We report safety bugs in open supply software program after we discover them as a result of it strengthens on-line safety for everybody,” Fb instructed BleepingComputer.
“We predict customers count on us to maintain engaged on methods to enhance safety. We stay vigilant and dedicated to defending folks’s non-public communications.”
Primarily based on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and the way to defend in opposition to them.
