Fb is warning {that a} FreeType vulnerability in all variations as much as 2.13 can result in arbitrary code execution, with reviews that the flaw has been exploited in assaults.
FreeType is a well-liked open-source font rendering library used to show textual content and programmatically add textual content to pictures. It supplies performance to load, rasterize, and render fonts in numerous codecs, similar to TrueType (TTF), OpenType (OTF), and others.
The library is put in in hundreds of thousands of techniques and companies, together with Linux, Android, recreation engines, GUI frameworks, and on-line platforms.
The vulnerability, tracked beneath CVE-2025-27363 and given a CVSS v3 severity rating of 8.1 (“excessive”), was fastened in FreeType model 2.13.0 on February ninth, 2023.
Fb disclosed the flaw yesterday, warning that the vulnerability is exploitable in all variations of FreeType as much as model 2.13 and that there are reviews of it actively being exploited in assaults.
“An out of bounds write exists in FreeType variations 2.13.0 and under when trying to parse font subglyph constructions associated to TrueType GX and variable font information,” reads the bulletin.
“The weak code assigns a signed brief worth to an unsigned lengthy after which provides a static worth inflicting it to wrap round and allocate too small of a heap buffer.”
“The code then writes as much as 6 signed lengthy integers out of bounds relative to this buffer. This may occasionally lead to arbitrary code execution.”
Fb might depend on FreeType in some capability, however it’s unclear if the assaults seen by its safety crew befell on its platform or if they found them elsewhere.
Contemplating the widespread use of FreeType throughout a number of platforms, software program builders and challenge directors should improve to FreeType 2.13.3 (newest model) as quickly as doable.
Though the newest weak model (2.13.0) dates two years, older library variations can persist in software program initiatives for prolonged intervals, making it necessary to handle the flaw as quickly as doable.
BleepingComputer requested Meta in regards to the flaw and the way it was exploited, and was despatched the next assertion.
“We report safety bugs in open supply software program once we discover them as a result of it strengthens on-line safety for everybody,” Fb advised BleepingComputer.
“We predict customers count on us to maintain engaged on methods to enhance safety. We stay vigilant and dedicated to defending individuals’s non-public communications.”
Primarily based on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and methods to defend in opposition to them.