Coverage › CVE-2025-27363

CVE-2025-27363 Mapped Sigma

FreeType Out-of-Bounds Write Vulnerability

Vendor / product

FreeType — FreeType

Description (CISA)

FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.

Added to KEV

2025-05-06

Due date

2025-05-27

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-787

CISA notes

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://source.android.com/docs/security/bulletin/2025-05-01
https://nvd.nist.gov/vuln/detail/CVE-2025-27363

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

6 mapping objects across 6 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such. Mappings marked mobile refer to ATT&CK Mobile; this site traverses the Enterprise bundle only and shows no detection chain for them.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1204.002 Malicious File exploitation technique

• DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
  AN0819 Windows

  User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

  Tunable: TimeWindow SuspiciousExtensions UserPaths ParentApps SignerAllowList
  AN0820 macOS

  User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.

  macos:unifiedlog process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder} → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions → DC0039 File Creation

  Tunable: TimeWindow QuarantineRequired ParentApps
  AN0821 Linux

  User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.

  auditd:SYSCALL open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions → DC0039 File Creation

  auditd:SYSCALL execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser → DC0032 Process Creation

  Tunable: TimeWindow DesktopParentMap

Sigma rules tagged attack.t1204.002 (39)

All 39 rules on the technique page →

T1499.004 Application or System Exploitation secondary impact

• DET0304 Detection Strategy for Endpoint DoS via Application or System Exploitation
  AN0850 Windows

  Exploitation of system or application vulnerability (e.g., CVE-based exploit) followed by service crash, restart, or repeated failure within a short time frame, impacting application/system availability.

  WinEventLog:Application EventCode=1000 → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:System EventCode=7031, 7034 → DC0060 Service Creation

  Tunable: TimeWindow TargetApplication
  AN0851 Linux

  User or remote input triggers application crash or segmentation fault (e.g., SIGSEGV) with service recovery attempts, observed via audit logs and systemd journaling.

  auditd:SYSCALL Process segfault or abnormal termination after invoking vulnerable syscall sequence → DC0033 Process Termination

  journald:Application Segfault or crash log entry associated with specific application binary → DC0038 Application Log Content

  NSM:Flow Unusual request pattern leading up to service crash (e.g., malformed or oversized payload) → DC0085 Network Traffic Content

  Tunable: CrashPattern ExploitSourceIP
  AN0852 macOS

  Application crash or repeated restart cycle triggered by malformed input or exploit file, observed via unified logs and process crash monitoring.

  macos:unifiedlog Crash log entries for a process receiving malformed input or known exploit patterns → DC0038 Application Log Content

  macos:unifiedlog Unusual child process tree indicating attempted recovery after crash → DC0032 Process Creation

  Tunable: CrashSignature InputVector
  AN0853 IaaS

  Cloud workload exploitation leads to repeated container, service, or VM termination/restart, typically associated with CVE-based crash triggers or fuzzed payloads.

  AWS:CloudTrail TerminateInstances → DC0089 Instance Stop

  AWS:CloudWatch Repeated crash pattern within container or instance logs → DC0038 Application Log Content

  AWS:VPCFlowLogs Large volume of malformed or synthetic payloads to application endpoints prior to failure → DC0085 Network Traffic Content

  Tunable: CrashThreshold ServiceID

Sigma rules tagged attack.t1499.004 (3)

T1574 Hijack Execution Flow primary impact

• DET0218 Detection Strategy for Hijack Execution Flow across OS platforms.
  AN0609 Windows

  Unusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Security EventCode=4657 → DC0063 Windows Registry Key Modification

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: ServiceBaseline AllowedDllPaths TimeWindow
  AN0610 Linux

  Adversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.

  auditd:SYSCALL open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin → DC0061 File Modification

  linux:syslog Service restart with modified executable path → DC0041 Service Metadata

  linux:osquery Process execution with LD_PRELOAD or modified library path → DC0032 Process Creation

  Tunable: MonitoredDirectories EnvVarMonitors
  AN0611 macOS

  Abuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.

  macos:unifiedlog Execution of process with DYLD_INSERT_LIBRARIES set → DC0032 Process Creation

  macos:unifiedlog Modified application plist or binary replacement in /Applications → DC0061 File Modification

  macos:unifiedlog Dylib loaded from abnormal location → DC0016 Module Load

  Tunable: AllowedDylibPaths PlistMonitors

Sigma rules tagged attack.t1574 (8)