Fb is warning {that a} FreeType vulnerability in all variations as much as 2.13 can result in arbitrary code execution, with reviews that the flaw has been exploited in assaults.
FreeType is a well-liked open-source font rendering library used to show textual content and programmatically add textual content to pictures. It offers performance to load, rasterize, and render fonts in varied codecs, equivalent to TrueType (TTF), OpenType (OTF), and others.
The library is put in in tens of millions of programs and providers, together with Linux, Android, sport engines, GUI frameworks, and on-line platforms.
The vulnerability, tracked beneath CVE-2025-27363 and given a CVSS v3 severity rating of 8.1 (“excessive”), was mounted in FreeType model 2.13.0 on February ninth, 2023.
Fb disclosed the flaw yesterday, warning that the vulnerability is exploitable in all variations of FreeType as much as model 2.13 and that there are reviews of it actively being exploited in assaults.
“An out of bounds write exists in FreeType variations 2.13.0 and beneath when trying to parse font subglyph buildings associated to TrueType GX and variable font information,” reads the bulletin.
“The susceptible code assigns a signed quick worth to an unsigned lengthy after which provides a static worth inflicting it to wrap round and allocate too small of a heap buffer.”
“The code then writes as much as 6 signed lengthy integers out of bounds relative to this buffer. This will likely lead to arbitrary code execution.”
Fb might depend on FreeType in some capability, however it’s unclear if the assaults seen by its safety crew befell on its platform or if they found them elsewhere.
Contemplating the widespread use of FreeType throughout a number of platforms, software program builders and challenge directors should improve to FreeType 2.13.3 (newest model) as quickly as potential.
Though the most recent susceptible model (2.13.0) dates two years, older library variations can persist in software program initiatives for prolonged intervals, making it essential to handle the flaw as quickly as potential.
BleepingComputer requested Meta concerning the flaw and the way it was exploited, and was despatched the next assertion.
“We report safety bugs in open supply software program once we discover them as a result of it strengthens on-line safety for everybody,” Fb informed BleepingComputer.
“We expect customers anticipate us to maintain engaged on methods to enhance safety. We stay vigilant and dedicated to defending individuals’s non-public communications.”
Primarily based on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and find out how to defend in opposition to them.
