CVE-2025-66034: Critical FontTools Vulnerability Enables Remote Code Execution

Overview

CVE-2025-66034 is a medium severity vulnerability discovered in FontTools, a Python library used for manipulating fonts. This vulnerability, present in versions 4.33.0 to before 4.60.2, allows for arbitrary file writes, potentially leading to remote code execution (RCE) when processing a malicious .designspace file.

Technical Details

The vulnerability resides within the fontTools.varLib script, specifically affecting the main() code path. This code path is invoked by the fonttools varLib command-line interface (CLI) and any other code that directly calls fontTools.varLib.main(). By crafting a malicious .designspace file, an attacker can exploit this flaw to write arbitrary files to the system, ultimately enabling them to execute arbitrary code.

CVSS Analysis

The Common Vulnerability Scoring System (CVSS) score for CVE-2025-66034 is 6.3 (Medium).

Possible Impact

Exploitation of CVE-2025-66034 can have significant consequences:

• Remote Code Execution (RCE): An attacker could execute arbitrary code on the affected system, potentially gaining full control.
• Data Breach: Sensitive data stored on the system could be compromised.
• System Compromise: An attacker could use the vulnerability to gain persistence and compromise the entire system.
• Denial of Service (DoS): The vulnerability could be exploited to crash the system or make it unavailable.

Mitigation and Patch Steps

The vulnerability has been patched in FontTools version 4.60.2. The recommended mitigation is to upgrade to version 4.60.2 or later. You can update FontTools using pip:

pip install fonttools --upgrade

Verify the installed version:

pip show fonttools

References

• GitHub Commit: https://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32
• GitHub Security Advisory: https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv