VulnerabilityAnalyzed

CVE-2025-66034

In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed.

CRITICAL 9.8EPSS 0.55%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.55% probability · 44th percentile
CISA KEV: Not listed
Weakness: CWE-91
Affected: fonttools/fonttools
Source: security-advisories@github.com

References

https://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32Patch
https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fvExploit, Vendor Advisory
https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fvExploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.