Google has released its month-to-month safety updates for Android with fixes for 46 safety flaws, together with one vulnerability that it stated has been exploited within the wild.
The vulnerability in query is CVE-2025-27363 (CVSS rating: 8.1), a high-severity flaw within the System part that might result in native code execution with out requiring any further execution privileges.
“Probably the most extreme of those points is a excessive safety vulnerability within the System part that might result in native code execution with no further execution privileges wanted,” Google stated in a Monday advisory. “Person interplay just isn’t wanted for exploitation.”
It is price noting that CVE-2025-27363 is rooted within the FreeType open-source font rendering library. It was first disclosed by Fb in March 2025 as having been exploited within the wild.
The shortcoming has been described as an out-of-bounds write flaw that might end in code execution when parsing TrueType GX and variable font recordsdata. The problem has been remediated in FreeType variations increased than 2.13.0.
“There are indications that CVE-2025-27363 could also be underneath restricted, focused exploitation,” Google acknowledged in its safety bulletin. The precise specifics of the assaults are presently unknown.
Google’s Could replace additionally resolves eight different flaws within the Android System and 15 flaws within the Framework module that might be abused to facilitate privilege escalation, data disclosure and denial-of-service.
“Exploitation for a lot of points on Android is made tougher by enhancements in newer variations of the Android platform,” the corporate stated. “We encourage all customers to replace to the most recent model of Android the place attainable.”
Source link