CVE-2025-66034
fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib
Vexday Risk Score
13Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 6.3EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
29 nov 2025Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L
Produtos afetados
fonttools · fonttoolsQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →