Skip to main content

Freetype CVE-2025-27363

HIGH
Out-of-bounds Write (CWE-787)
2025-03-11 cve-assign@fb.com
RCE Buffer Overflow Memory Corruption Debian Debian Linux Freetype
8.1
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Deliver crafted TrueType GX font file
  2. Delivery
    Victim application invokes FreeType parser
  3. Exploit
    Trigger integer wrap in subglyph processing
  4. Install
    Undersized heap buffer allocated
  5. C2
    Write 6 signed longs out of bounds
  6. Execute
    Overwrite heap metadata/pointers
  7. Impact
    Execute arbitrary code in app context

Vulnerability Assessment

Weakness
CWE
CWE-787
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target system to process a specially-crafted TrueType GX or variable font file containing malicious subglyph structures. No user interaction required (UI:N)-applications that automatically parse fonts during document rendering, web page display, or email preview trigger the vulnerability without user action. No authentication required (PR:N)-any network-accessible service or application processing untrusted fonts is exploitable. High attack complexity (AC:H) indicates successful exploitation requires precise heap layout manipulation and knowledge of target memory architecture, but CISA KEV status confirms attackers have overcome these technical barriers. Limiting factors: Exploitation depends on applications using FreeType versions ≤2.13.0 for font rendering; systems with modern exploit mitigations (ASLR, DEP, CFI) may resist but not prevent exploitation; the AC:H rating suggests some environmental factors affect reliability. Critical exposure: Applications that auto-render fonts from network sources (browsers, email clients) or parse untrusted documents (PDF viewers, office suites) present highest risk surface.
Impact

Critical real-world risk confirmed by multiple converging signals. CISA KEV listing verifies confirmed active exploitation in the wild, elevating this beyond theoretical concern. EPSS score of 76.15% (99th percentile) indicates attackers are successfully exploiting this vulnerability at scale. CVSS 8.1 with network attack vector (AV:N) but high complexity (AC:H) reflects that while exploitation requires specially-crafted font files, delivery is achievable via web content, email attachments, or document embedding. No authentication required (PR:N) and no user interaction needed (UI:N) for applications that auto-process fonts. Scope unchanged (S:U) limits damage to the vulnerable component's context, but high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H) enable arbitrary code execution. The AC:H rating suggests exploitation requires precise heap manipulation, yet confirmed real-world use proves attackers have overcome this barrier. Android Security Bulletin inclusion (May 2025) indicates mobile platform exposure. FreeType's ubiquity as a dependency in browsers, document viewers, and system rendering engines creates massive attack surface. SSVC framework assessment: exploitation=active, automatable=no (requires crafted fonts), technical impact=total (RCE). This is a defend-now priority despite complexity rating-active exploitation trumps theoretical difficulty. The high EPSS score despite AC:H suggests targeted campaigns have industrialized exploitation.
Exploit ScenarioDerived

Attacker embeds malicious TrueType GX or variable font file in web content, email attachment, or document. When victim's application (browser, email client, document viewer) automatically processes the font for text rendering, FreeType's subglyph parser triggers the integer wrapping flaw, allocating an undersized heap buffer and writing 24-48 bytes out of bounds. Attacker-controlled font data overwrites adjacent heap metadata or function pointers, achieving arbitrary code execution in the context of the vulnerable application without user interaction. Given CISA KEV confirmation, real-world exploitation has occurred via these or similar delivery methods.
Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 76.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv4 – Apr 20, 2026

Arbitrary code execution in FreeType 2.13.0 and earlier via heap buffer overflow when parsing TrueType GX/variable font subglyph structures. Confirmed actively exploited in the wild (CISA KEV). Attack requires high complexity but no authentication, affecting widespread deployments including Android, Debian, and applications embedding FreeType for font rendering. EPSS score of 76.15% (99th percentile) reflects significant real-world exploitation risk. Vendor patches available; immediate upgrade to post-2.13.0 versions critical.

Earlier versions of this analysis (3)
v3 Apr 19, 2026 - 23:29 cvss changed CVSS 8.1

Remote code execution in FreeType library versions 2.13.0 and below allows unauthenticated network attackers to execute arbitrary code through maliciously crafted TrueType GX or variable font files. The vulnerability stems from an integer overflow during font subglyph parsing that causes undersized heap allocation, followed by out-of-bounds writes of up to six signed long integers. CISA KEV confirms active exploitation in the wild with EPSS score of 76.15% (99th percentile), indicating very high real-world risk. FreeType is embedded in countless applications across all platforms for font rendering, making the attack surface extremely broad despite high attack complexity.

v2 Apr 17, 2026 - 13:43 cvss changed CVSS 8.1

Remote code execution in FreeType library versions 2.13.0 and below allows unauthenticated network attackers to execute arbitrary code by delivering malicious TrueType GX or variable font files. This vulnerability is confirmed actively exploited (CISA KEV) with an EPSS score of 76.15% (99th percentile), indicating extremely high real-world exploitation likelihood. The out-of-bounds write occurs during font subglyph parsing, enabling heap corruption leading to code execution. Given FreeType's extensive deployment in browsers, document readers, operating systems, and mobile platforms, the attack surface is exceptionally broad.

v1 Mar 12, 2026 - 19:52 CVSS 8.1

FreeType's TrueType GX and variable font subglyph structure parser contains an integer signedness error (CWE-787) where a signed short value is assigned to an unsigned long, causing integer wraparound that leads to undersized heap allocation and subsequent out-of-bounds write during font rendering.

RemediationAI

Upgrade FreeType to versions newer than 2.13.0 immediately-vendor patches available per NVD data and confirmed by multiple distribution advisories at http://www.openwall.com/lists/oss-security/2025/03/13/ series. Debian users should apply updates via standard apt channels referencing https://lists.debian.org/debian-lts-announce/2025/03/msg00030.html. Android users must install May 2025 security patches per https://source.android.com/docs/security/bulletin/2025-05-01. For environments unable to upgrade immediately, implement these compensating controls with noted limitations: (1) Disable processing of untrusted font files in applications-blocks attack vector but breaks functionality requiring external fonts; (2) Deploy application sandboxing and CFI/DEP protections-reduces exploitation success but does not prevent vulnerability; (3) Block network delivery of font files via web content filtering-mitigates remote exploitation but ineffective against local/email vectors; (4) Restrict font installation to administrator-only-limits exposure but UI:N means no user action required for auto-processing applications. No workaround eliminates risk; patching is mandatory given confirmed active exploitation.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

FreeType is a widely-deployed open-source font rendering library used in Android, Linux distributions, browsers, and numerous applications requiring text rendering. This vulnerability (CWE-787: Out-of-bounds Write) occurs in FreeType's TrueType GX and variable font parsing code when processing subglyph structures. The flaw involves a type confusion error where a signed short value is incorrectly assigned to an unsigned long variable, then incremented by a static value. This integer wrapping causes miscalculation of required heap buffer size. Subsequently, the code writes up to six signed long integers (24-48 bytes) beyond the undersized buffer boundary, enabling heap memory corruption. TrueType GX and variable fonts use advanced OpenType/TrueType features for glyph variations and transformations-complex data structures that require careful bounds checking during parsing. The vulnerability exists in font parsing paths automatically invoked when applications render text from untrusted font files.

Know when Freetype gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.1 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Apr 20, 2026 - 13:30 vuln.today
v4 - CVSS changed
Analysis Updated
Apr 19, 2026 - 23:29 vuln.today
v3 - CVSS changed
Analysis Updated
Apr 17, 2026 - 13:43 vuln.today
v2 - CVSS changed
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Added to CISA KEV
Oct 27, 2025 - 17:06 cisa
CISA KEV
CVE Published
Mar 11, 2025 - 14:15 nvd
HIGH 8.1

DescriptionCVE.org

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

Executive ViewAI

Why It Matters

FreeType 2.13.0 and earlier contains a critical heap buffer overflow vulnerability (CVE-2025-27363) enabling unauthenticated remote code execution through maliciously crafted TrueType variable fonts. This vulnerability is confirmed actively exploited (CISA KEV) with an 8.1 CVSS score and 76.2% EPSS probability, affecting all organizations using FreeType in Android deployments, Linux distributions, web browsers, and embedded applications-requiring immediate patching to prevent system compromise.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If patch deployment is delayed: (1) restrict font file sources to vetted, trusted repositories only; (2) disable or isolate applications accepting user-supplied font files pending updates; (3) implement file-type validation rejecting TrueType variable fonts (.ttf/.otf files) at network entry points; (4) enable enhanced endpoint detection for process anomalies following font processing; (5) segment systems running FreeType from critical assets until patched.

Threat Intelligence Overview

Threat Score
5.4/10
Composite threat intelligence
EPSS Score
76.2%
Top 1% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org CISA KEV EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV Yes
Public POC No
EPSS 76.2%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Very High

Priority Score

166
Low Medium High Critical
KEV: +50
EPSS: +76
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

More in Freetype

View all
CVE-2022-27404 CRITICAL POC
9.8 Apr 22

FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the functi
CVE-2020-15999 CRITICAL POC
9.6 Nov 03

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploi
CVE-2014-9662 HIGH POC
7.5 Feb 08

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows rem
CVE-2014-9674 HIGH POC
7.5 Feb 08

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values with
CVE-2014-9660 HIGH POC
7.5 Feb 08

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR recor
CVE-2014-9665 HIGH POC
7.5 Feb 08

The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG
CVE-2014-9661 HIGH POC
7.5 Feb 08

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error
CVE-2014-9659 HIGH POC
7.5 Feb 08

cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint

CVE-2014-9663 HIGH POC
7.5 Feb 08

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that fi
CVE-2022-27406 HIGH POC
7.5 Apr 22

FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the func
CVE-2014-9656 HIGH POC
7.5 Feb 08

The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer
CVE-2016-10244 HIGH POC
7.8 Mar 06

The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph n

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container bci/kiwi:9.24.43-10.1 Container bci/openjdk-devel:17.0.15.0-7.6 Container bci/openjdk-devel:25.0.1.0-2.1 Container bci/openjdk:17.0.15.0-7.6 Container bci/openjdk:25.0.1.0-2.1 Container containers/lmcache-vllm-openai:0.3.2-1.2 Container containers/open-webui:0.5.14-9.11 Container containers/vllm-openai:0.9.1-1.2 Container private-registry/harbor-nginx:1.21.5-2.15 Container private-registry/harbor-portal:1.1.0-1.1 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.5.1 Container suse/kiosk/firefox-esr:esr Container suse/kiosk/pulseaudio:17 Container suse/kiosk/xorg:21 Container suse/manager/5.0/x86_64/server-attestation:5.0.4.6.14.1 Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1 Container suse/multi-linux-manager/5.1/x86_64/server-attestation:5.1.0.6.20 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40 Container suse/nginx:1.21-51.42 Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:latest Container suse/sle-micro/base-5.5:2.0.4-5.8.154 Image SLES15-SP3-BYOS-Azure Image SLES15-SP3-BYOS-EC2-HVM Image SLES15-SP3-BYOS-GCE Image SLES15-SP3-HPC-BYOS-Azure Image SLES15-SP3-HPC-BYOS-EC2-HVM Image SLES15-SP3-HPC-BYOS-GCE Image SLES15-SP3-Micro-5-1-BYOS-Azure Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-1-BYOS-GCE Image SLES15-SP3-Micro-5-2-BYOS-Azure Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-2-BYOS-GCE Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-BYOS-Azure Image SLES15-SP3-SAP-BYOS-EC2-HVM Image SLES15-SP3-SAP-BYOS-GCE Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-CHOST-BYOS Image SLES15-SP4-CHOST-BYOS-Aliyun Image SLES15-SP4-CHOST-BYOS-Azure Image SLES15-SP4-CHOST-BYOS-EC2 Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-SAP-CCloud Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-Hardened-BYOS-GCE Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-Micro-5-3 Image SLES15-SP4-Micro-5-3-BYOS Image SLES15-SP4-Micro-5-3-BYOS-Azure Image SLES15-SP4-Micro-5-3-BYOS-EC2 Image SLES15-SP4-Micro-5-3-BYOS-GCE Image SLES15-SP4-Micro-5-3-EC2 Image SLES15-SP4-Micro-5-4 Image SLES15-SP4-Micro-5-4-BYOS Image SLES15-SP4-Micro-5-4-BYOS-Azure Image SLES15-SP4-Micro-5-4-BYOS-EC2 Image SLES15-SP4-Micro-5-4-BYOS-GCE Image SLES15-SP4-Micro-5-4-EC2 Image SLES15-SP4-Micro-5-4-GCE Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-BYOS-GCE Image SLES15-SP4-SAP-Hardened Image SLES15-SP4-SAP-Hardened-Azure Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP4-SAP-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Hardened-GCE Image SLES15-SP5-Azure-3P Image SLES15-SP5-Azure-Basic Image SLES15-SP5-Azure-Standard Image SLES15-SP5-BYOS-Azure Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-Aliyun Image SLES15-SP5-CHOST-BYOS-Azure Image SLES15-SP5-CHOST-BYOS-EC2 Image SLES15-SP5-CHOST-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-GDC Image SLES15-SP5-CHOST-BYOS-SAP-CCloud Image SLES15-SP5-EC2 Image SLES15-SP5-GCE Image SLES15-SP5-HPC-Azure Image SLES15-SP5-HPC-BYOS-Azure Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-Hardened-BYOS-Azure Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-GCE Image SLES15-SP5-Manager-Proxy-5-0-BYOS Image SLES15-SP5-Manager-Proxy-5-0-BYOS-Azure Image SLES15-SP5-Manager-Proxy-5-0-BYOS-EC2 Image SLES15-SP5-Manager-Proxy-5-0-BYOS-GCE Image SLES15-SP5-Manager-Server-5-0 Image SLES15-SP5-Manager-Server-5-0-Azure-llc Image SLES15-SP5-Manager-Server-5-0-Azure-ltd Image SLES15-SP5-Manager-Server-5-0-BYOS Image SLES15-SP5-Manager-Server-5-0-BYOS-Azure Image SLES15-SP5-Manager-Server-5-0-BYOS-EC2 Image SLES15-SP5-Manager-Server-5-0-BYOS-GCE Image SLES15-SP5-Manager-Server-5-0-EC2-llc Image SLES15-SP5-Manager-Server-5-0-EC2-ltd Image SLES15-SP5-Micro-5-5 Image SLES15-SP5-Micro-5-5-Azure Image SLES15-SP5-Micro-5-5-BYOS Image SLES15-SP5-Micro-5-5-BYOS-Azure Image SLES15-SP5-Micro-5-5-BYOS-EC2 Image SLES15-SP5-Micro-5-5-BYOS-GCE Image SLES15-SP5-Micro-5-5-EC2 Image SLES15-SP5-Micro-5-5-GCE Image SLES15-SP5-SAP-Azure-3P Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-BYOS-Azure Image SLES15-SP5-SAP-BYOS-EC2 Image SLES15-SP5-SAP-BYOS-GCE Image SLES15-SP5-SAP-Hardened-Azure Image SLES15-SP5-SAP-Hardened-BYOS-Azure Image SLES15-SP5-SAP-Hardened-BYOS-EC2 Image SLES15-SP5-SAP-Hardened-BYOS-GCE Image SLES15-SP5-SAP-Hardened-GCE Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP-Azure-3P Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-Azure Image SLES15-SP6-SAP-BYOS-EC2 Image SLES15-SP6-SAP-BYOS-GCE Image SLES15-SP6-SAP-Hardened Image SLES15-SP6-SAP-Hardened-Azure Image SLES15-SP6-SAP-Hardened-BYOS Image SLES15-SP6-SAP-Hardened-BYOS-Azure Image SLES15-SP6-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-BYOS-GCE Image SLES15-SP6-SAP-Hardened-EC2 Image SLES15-SP6-SAP-Hardened-GCE Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-GCE-3P Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Image ai_15_6 Image server-attestation-image Image server-image Affected
Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP3-SAPCAL-Azure Image SLES15-SP3-SAPCAL-EC2-HVM Image SLES15-SP3-SAPCAL-GCE Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
SUSE Enterprise Storage 7.1 Fixed
SUSE Liberty Linux 7 LTSS Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:3382 ADVISORY https://access.redhat.com/errata/RHSA-2025:3383 ADVISORY https://access.redhat.com/errata/RHSA-2025:3384 ADVISORY https://access.redhat.com/errata/RHSA-2025:3385 ADVISORY https://access.redhat.com/errata/RHSA-2025:3386 ADVISORY https://access.redhat.com/errata/RHSA-2025:3387 ADVISORY https://access.redhat.com/errata/RHSA-2025:3393 ADVISORY https://access.redhat.com/errata/RHSA-2025:3395 ADVISORY https://access.redhat.com/errata/RHSA-2025:3407 ADVISORY https://access.redhat.com/errata/RHSA-2025:3421 ADVISORY https://access.redhat.com/errata/RHSA-2025:3573 ADVISORY https://access.redhat.com/errata/RHSA-2025:8195 ADVISORY https://access.redhat.com/errata/RHSA-2025:8219 ADVISORY https://access.redhat.com/errata/RHSA-2025:8253 ADVISORY https://access.redhat.com/errata/RHSA-2025:8292 ADVISORY https://access.redhat.com/errata/RHSA-2025:9380 ADVISORY https://vuldb.com/vuln/299266 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0960/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0998/ REF http://www.openwall.com/lists/oss-security/2025/03/13/1 REF http://www.openwall.com/lists/oss-security/2025/03/13/11 REF http://www.openwall.com/lists/oss-security/2025/03/13/12 REF http://www.openwall.com/lists/oss-security/2025/03/13/2 REF http://www.openwall.com/lists/oss-security/2025/03/13/3 REF http://www.openwall.com/lists/oss-security/2025/03/13/8 REF http://www.openwall.com/lists/oss-security/2025/03/14/1 REF http://www.openwall.com/lists/oss-security/2025/03/14/2 REF http://www.openwall.com/lists/oss-security/2025/03/14/3 REF http://www.openwall.com/lists/oss-security/2025/03/14/4 REF http://www.openwall.com/lists/oss-security/2025/05/06/3 REF http://www.openwall.com/lists/oss-security/2026/04/16/5 REF http://www.openwall.com/lists/oss-security/2026/04/19/3 REF https://lists.debian.org/debian-lts-announce/2025/03/msg00030.html REF https://source.android.com/docs/security/bulletin/2025-05-01 REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27363 REF https://www.facebook.com/security/advisories/cve-2025-27363

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy