CVE-2025-27363: FontForge affected by FreeType heap-buffer-overflow; upstream maintainer declines under Community-guidelines #D1

[yangjincheng1998 () gmail com]

Hello oss-security,

This is an information-only post documenting a downstream impact and
maintainer response for an existing, already-public CVE.

== CVE ==
CVE-2025-27363 -- FreeType <= 2.13.2 heap-buffer-overflow in
load_truetype_glyph(), src/truetype/ttgload.c (~line 1929).
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-27363
Fix: FreeType 2.13.3, upstream commit a1e5a9df.

== Downstream impact: FontForge ==
FontForge (https://github.com/fontforge/fontforge) links FreeType to
parse and process font files. When built or run against FreeType
<= 2.13.2, FontForge inherits the heap-buffer-overflow when opening
a maliciously crafted TrueType font.

We confirmed the issue with AddressSanitizer against FreeType 2.13.0
(common in distributions that have not backported the fix):

  ==ERROR: AddressSanitizer: heap-buffer-overflow
   WRITE of size 16 at ttgload.c:1929 in load_truetype_glyph
   0 bytes to the right of 16-byte region allocated at ttgload.c:1909

Recommended action for distributors and packagers: ensure FontForge is
built/linked against FreeType >= 2.13.3, or apply the upstream fix
(commit a1e5a9df).

== Upstream maintainer response ==
We reported this downstream impact to FontForge upstream as
https://github.com/fontforge/fontforge/issues/5799 (2026-04-15).
The issue was closed within hours under "Community-guidelines #D1",
which states that the project does not accept security reports without
an accompanying fix PR.

Context: ZDI submitted 12 unrelated FontForge CVEs in 2025-12 and
received the same response
(https://github.com/fontforge/fontforge/issues/5706).

We post here so distributors and downstream packagers have a public,
independent record of the FontForge -> FreeType linkage status, and
can verify their own builds.

== Reproducer ==
Public PoC: https://github.com/francozappa/poc-CVE-2025-27363
Build/run FontForge against FreeType 2.13.0 or 2.13.2 with the PoC
TTF to reproduce.

Regards,
vulgraph
(Academic security research; PhD work on 1-day vulnerability
propagation across forks and downstream consumers.)