critical
CVE-2025-66034
fonttools: fontTools: Arbitrary file write leading to remote code execution via malicious .designspace file
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA6.3CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L
Red Hat6.3CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (medium), Red Hat (medium), Ubuntu (medium).
Description
fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| chainguard | mlflow, open-webui, tensorflow-cpu-jupyter and 1 more | 3.6.0-r1 and 3 more |
| debian 11 | fonttools | no fix listed |
| debian 12 | fonttools | 4.38.0-1+deb12u1 |
| debian 13 | fonttools | 4.57.0-1+deb13u1 |
| debian 14 | fonttools | 4.61.1-1 |
| echo | fonttools | 4.38.0-1+deb12u1 |
| pip::GitHub Security Advisory pip | fonttools | 4.60.2 |
| rapidfort debian 12 | fonttools | 0:4.57.0-1+deb13u1, 0:4.61.1-1 |
| rapidfort debian 13 | fonttools | 0:4.57.0-1+deb13u1, 0:4.61.1-1 |
| rapidfort fedora 43 | fonttools, python3-fonttools, python3-fonttools+graphite and 9 more | 4.61.0-1.fc43 |
| rapidfort Oracle Linux 10 | fonttools, python3-fonttools, python3-fonttools+graphite and 9 more | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 9 | fonttools, python3-fonttools, python3-fonttools+graphite and 9 more | no fix listed |
Show all 59 entries from 22 sources
| Source | Package | Fixed in |
|---|---|---|
| chainguard | mlflow | 3.6.0-r1 |
| chainguard | open-webui | 0.9.2-r0 |
| chainguard | tensorflow-cpu-jupyter | 2.20.0-r5 |
| chainguard | tensorflow-gpu-jupyter | 2.20.0-r4 |
| debian 11 | fonttools | no fix listed |
| debian 12 | fonttools | 4.38.0-1+deb12u1 |
| debian 13 | fonttools | 4.57.0-1+deb13u1 |
| debian 14 | fonttools | 4.61.1-1 |
| echo | fonttools | 4.38.0-1+deb12u1 |
| pip::GitHub Security Advisory pip | fonttools | 4.60.2 |
| rapidfort debian 12 | fonttools | 0:4.57.0-1+deb13u1, 0:4.61.1-1 |
| rapidfort debian 13 | fonttools | 0:4.57.0-1+deb13u1, 0:4.61.1-1 |
| rapidfort fedora 43 | fonttools | 4.61.0-1.fc43 |
| rapidfort fedora 43 | python3-fonttools | 4.61.0-1.fc43 |
| rapidfort fedora 43 | python3-fonttools+graphite | 4.61.0-1.fc43 |
| rapidfort fedora 43 | python3-fonttools+interpolatable | 4.61.0-1.fc43 |
| rapidfort fedora 43 | python3-fonttools+lxml | 4.61.0-1.fc43 |
| rapidfort fedora 43 | python3-fonttools+plot | 4.61.0-1.fc43 |
| rapidfort fedora 43 | python3-fonttools+repacker | 4.61.0-1.fc43 |
| rapidfort fedora 43 | python3-fonttools+symfont | 4.61.0-1.fc43 |
| rapidfort fedora 43 | python3-fonttools+type1 | 4.61.0-1.fc43 |
| rapidfort fedora 43 | python3-fonttools+ufo | 4.61.0-1.fc43 |
| rapidfort fedora 43 | python3-fonttools+unicode | 4.61.0-1.fc43 |
| rapidfort fedora 43 | python3-fonttools+woff | 4.61.0-1.fc43 |
| rapidfort Oracle Linux 10 | fonttools | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 10 | python3-fonttools | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 10 | python3-fonttools+graphite | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 10 | python3-fonttools+interpolatable | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 10 | python3-fonttools+lxml | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 10 | python3-fonttools+plot | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 10 | python3-fonttools+repacker | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 10 | python3-fonttools+symfont | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 10 | python3-fonttools+type1 | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 10 | python3-fonttools+ufo | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 10 | python3-fonttools+unicode | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 10 | python3-fonttools+woff | 4.61.0-2.el10_2 |
| rapidfort Oracle Linux 9 | fonttools | no fix listed |
| rapidfort Oracle Linux 9 | python3-fonttools | no fix listed |
| rapidfort Oracle Linux 9 | python3-fonttools+graphite | no fix listed |
| rapidfort Oracle Linux 9 | python3-fonttools+interpolatable | no fix listed |
| rapidfort Oracle Linux 9 | python3-fonttools+lxml | no fix listed |
| rapidfort Oracle Linux 9 | python3-fonttools+plot | no fix listed |
| rapidfort Oracle Linux 9 | python3-fonttools+repacker | no fix listed |
| rapidfort Oracle Linux 9 | python3-fonttools+symfont | no fix listed |
| rapidfort Oracle Linux 9 | python3-fonttools+type1 | no fix listed |
| rapidfort Oracle Linux 9 | python3-fonttools+ufo | no fix listed |
| rapidfort Oracle Linux 9 | python3-fonttools+unicode | no fix listed |
| rapidfort Oracle Linux 9 | python3-fonttools+woff | no fix listed |
| rapidfort ubuntu 20.04 | fonttools | 0:4.55.3-2ubuntu0.25.04.1 |
| rapidfort ubuntu 22.04 | fonttools | 0:4.55.3-2ubuntu0.25.04.1 |
| rapidfort ubuntu 24.04 | fonttools | 0:4.55.3-2ubuntu0.25.04.1 |
| Red Hat | fonttools | no fix listed |
| ubuntu 24.04 | fonttools | no fix listed |
| ubuntu 25.04 | fonttools | 4.55.3-2ubuntu0.25.04.1 |
| ubuntu 25.10 | fonttools | 4.55.3-2ubuntu0.25.10.1 |
| ubuntu 26.04 | fonttools | 4.57.0-3ubuntu1 |
| ubuntu 26.10 | fonttools | 4.57.0-3ubuntu1 |
| wolfi | mlflow | 3.6.0-r1 |
| wolfi | open-webui | 0.9.2-r0 |
References
- https://access.redhat.com/security/cve/CVE-2025-66034
- https://github.com/fonttools/fonttools
- https://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32
- https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv
- https://nvd.nist.gov/vuln/detail/CVE-2025-66034
- https://ubuntu.com/security/notices/USN-7917-1
- https://www.cve.org/CVERecord?id=CVE-2025-66034