Loading vulnerability…
CVE-2025-27363 is an out-of-bounds write vulnerability in FreeType’s TrueType font loading component, affecting versions prior to 2.13.3. The flaw occurs while parsing font subglyph structures associated with TrueType GX and variable font files. In the vulnerable code path, a signed short value is assigned to an unsigned long and then incremented by a static value, causing integer wraparound. This results in allocation of an undersized heap buffer, after which the parser writes up to six signed long integers beyond the bounds of that buffer. Public reporting places the vulnerable logic in the TrueType glyph loading path, including load_truetype_glyph() in src/truetype/ttgload.c. The memory corruption condition may enable arbitrary code execution, and exploitation has been reported in the wild.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a sophisticated proof-of-concept (PoC) exploit for CVE-2025-27363, a memory corruption vulnerability in Google Chrome (specifically Chrome 113, commit a7a083d) affecting PartitionAlloc. The exploit is tailored for Chrome running in headless mode on Linux (Ubuntu 20/24). The structure includes: - A Python script (font_gen_POC.py) that generates a malicious TrueType font (TTF) file designed to trigger the vulnerability. - Multiple HTML/JavaScript PoCs (in poc_leak, poc_rce, and tests/) that use advanced heap manipulation, CSS variables, and WebAssembly to shape memory and exploit the vulnerability. - Bash scripts to automate launching Chrome with the necessary flags and debugging tools (GDB) for both information leak and RCE stages. - GDB scripts to assist in debugging and analyzing the exploit's effects on Chrome's memory. The main exploitation flow involves serving a crafted HTML file (poc01.html) to a vulnerable Chrome instance, which loads the malicious font and executes JavaScript to manipulate memory allocations. The exploit achieves arbitrary code execution by corrupting vtables and leveraging system gadgets (e.g., execvp) within the Chrome process. The repository is well-structured for both research and demonstration purposes, with clear separation between information leak and RCE stages, and includes test cases for various heap manipulation scenarios. The exploit is operational and demonstrates a full chain from memory corruption to code execution, but is not weaponized for mass exploitation.
This repository consists of a single HTML file ('index.html') containing JavaScript code that uses the FontFace API to load an external font file ('mal.ttf'). The script attempts to load the font, add it to the document, and set it as the font for the page, displaying '%%' as the content. The exploit's purpose appears to be testing or demonstrating the loading of a potentially malicious font file in a browser context. There are no hardcoded network endpoints, but the file 'mal.ttf' is referenced and must be accessible for the exploit to function. The code is a proof-of-concept for browser-based font loading and could be used to test for vulnerabilities related to font parsing in browsers.
This repository is a proof-of-concept exploit for CVE-2025-27363, a heap buffer overflow in FreeType 2.13.0. The exploit works by modifying the Roboto Flex font to create a malicious version of the '%' glyph, making it a composite glyph with 0xfffd subglyphs. The repository contains scripts to download the original font (download_roboto_flex.sh), convert it to XML, modify it using a Python script (givememore.py), and rebuild the malicious font (buildfont.sh). When the generated font (rf2.ttf) is rendered by FreeType 2.13.0, it triggers a heap buffer overflow, as demonstrated by the included ASAN crash logs. The exploit targets systems or applications that use FreeType 2.13.0 to process untrusted font files. No remote network exploitation is present; the attack vector is local, requiring the target to process the crafted font file.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
67 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An integer wrap-around vulnerability in FreeType's TrueType font loading component that leads to an undersized heap allocation and subsequent out-of-bounds write during parsing of crafted TrueType GX and variable font files, enabling heap memory corruption.
An Android System component vulnerability leading to local code execution without additional execution privileges; exploited in the wild.
An out-of-bounds write in the FreeType font rendering library that may enable remote code execution when parsing certain fonts; warned as potentially exploited in the wild.
A security flaw in FreeType exploited as a zero-day in Paragon Graphite spyware attacks, delivered via WhatsApp, targeting journalists and civil society members.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.