F
freetype logo
Vendor security profile1 actively exploited CVEs

freetype

Product portfolio, patch evidence and exploitation signals in a single security scorecard

Open the CVE list
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.Scope: all CVE records matched to the company · Source evidence is on each CVE's page
Total CVEs3
Critical0
CISA KEV1
Public exploit2
Patch rate%33
Avg. CVSS7.7

12-month vulnerability rate

CVEs published, and the CISA KEV records among them

0
0
0
0
0
0
0
0
0
0
0
0
CVE KEV

CVE severity distribution

The company's whole portfolio of recorded CVEs

3toplam CVE
High3 (100%)

Patch and exploitation view

Patch evidence, public exploits and active exploitation signals together

%33

Verified patch

1 records

%33

CISA KEV

1 records

%67

Public exploit

2 records

1Patch available
0Partial
0Workaround
0Vendor: no patch
2Unknown

Latest vulnerabilities

The 10 newest records · metrics are calculated over the whole period

View all
8.1
CVE-2025-27363 Actively exploitedAn out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
F
freetype logo
VendorfreetypeProductfreetype
Patch verifiedEPSS %281 y ago