CVE-2025-27363: out of bounds write in FreeType <= 2.13.0

[Douglas Bagnall <douglas.bagnall () catalyst net nz>]

I don't know much about this bug, which seems to have been announced
by Facebook yesterday.

https://nvd.nist.gov/vuln/detail/CVE-2025-27363

> An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures
> related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long
> and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes
> up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This
> vulnerability may have been exploited in the wild.

The latest version of FreeType is 2.13.3 which is NOT affected, according
to the announcement. Recent distro versions (e.g. Ubuntu 24.04 with 2.13.2)
also look safe.

However, older distro versions seem to  have affected libraries. For example
Debian Bookworm has "2.12.1+dfsg-5+deb12u3", which is less than "2.13.0".

The bug would not be too concerning if people only used trusted fonts,
as used to be routine. But webpages now embed fonts, and the affected
"variable font files" format is widely used in browsers. It allows
parametric adjustment of font properties, described here:

https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_fonts/Variable_fonts_guide

However, it looks like the browsers themselves might be embedding
unaffected recent versions of FreeType. For example, I see Mozilla
have a commit with the message:

> Bug 1912903 - Update freetype2 to 2.13.3.

https://github.com/mozilla/gecko-dev/commit/026f6a947085020cd189dd9af3da00be433a44f8

I know there's some tension between bundling and unbundling tendencies
in the packaging of browsers, so I am not sure how exposed anyone is.

Anyway, I don't see patches for 2.11.x and 2.12.x in stable/LTS releases,
and the FreeType website seems pretty quiet about this.


Douglas