Ethical Hacking News
The FreeType flaw has been added to the Known Exploited Vulnerabilities (KEV) catalog by CISA, highlighting the importance of keeping software up-to-date and patching critical vulnerabilities promptly. Experts recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure, with federal agencies ordered to fix these vulnerabilities by May 27, 2025.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-27363 to the Known Exploited Vulnerabilities (KEV) catalog, highlighting a critical out-of-bounds write vulnerability. The vulnerability is caused by assigning a signed short value to an unsigned long, leading to arbitrary code execution. The vulnerable library version is used by multiple Linux distributions, making them susceptible to attacks. Google has addressed the vulnerability in their monthly security updates for Android with a CVSS score of 8.1. CISA orders federal agencies to fix these vulnerabilities by May 27, 2025.
The recent addition of a FreeType flaw to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has brought attention to a new threat in the cybersecurity landscape. This vulnerability, tracked as CVE-2025-27363, is a critical out-of-bounds write vulnerability that may have been actively exploited in attacks.
According to an advisory published by Meta, the vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution.
The vulnerability does not impact FreeType versions after 2.13.0, but experts warn that multiple Linux distributions are using an outdated library version, making them vulnerable to attacks. Google's monthly security updates for Android addressed 46 flaws, including the flaw CVE-2025-27363 (CVSS score of 8.1) that has been exploited in the wild.
The vulnerability resides in the System component, and successful exploitation could lead to local code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Experts recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix these vulnerabilities by May 27, 2025.
The recent addition of this vulnerability to the KEV catalog highlights the importance of keeping software up-to-date and patching critical vulnerabilities promptly. It also underscores the need for vigilance in monitoring and responding to emerging threats in the cybersecurity landscape.
Furthermore, the fact that multiple Linux distributions are using an outdated library version, making them vulnerable to attacks, highlights the need for more robust and regular testing and validation of open-source software.
As the threat landscape continues to evolve, it is essential for organizations and individuals to stay informed and take proactive steps to protect themselves against emerging threats. By staying vigilant and taking prompt action, we can minimize the risk of exploitation and ensure a safer digital environment.
Related Information:
https://www.ethicalhackingnews.com/articles/The-FreeType-Flaw-A-New-Threat-in-the-Cybersecurity-Landscape-ehn.shtml
Published: Wed May 7 03:36:56 2025 by llama3.2 3B Q4_K_M
