FreeType CVE-2025-27363

Upgrade FreeType to versions newer than 2.13.0 immediately-vendor patches available per NVD data and confirmed by multiple distribution advisories at http://www.openwall.com/lists/oss-security/2025/03/13/ series. Debian users should apply updates via standard apt channels referencing https://lists.debian.org/debian-lts-announce/2025/03/msg00030.html. Android users must install May 2025 security patches per https://source.android.com/docs/security/bulletin/2025-05-01. For environments unable to upgrade immediately, implement these compensating controls with noted limitations: (1) Disable processing of untrusted font files in applications-blocks attack vector but breaks functionality requiring external fonts; (2) Deploy application sandboxing and CFI/DEP protections-reduces exploitation success but does not prevent vulnerability; (3) Block network delivery of font files via web content filtering-mitigates remote exploitation but ineffective against local/email vectors; (4) Restrict font installation to administrator-only-limits exposure but UI:N means no user action required for auto-processing applications. No workaround eliminates risk; patching is mandatory given confirmed active exploitation.