CVE-2025-66034

Published Nov 29, 2025

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-66034 affects fontTools, a Python library for manipulating fonts. Specifically, versions 4.33.0 to before 4.60.2 contain an arbitrary file write vulnerability within the `fontTools.varLib` script. This vulnerability can be triggered when processing a malicious `.designspace` file. The vulnerability lies in the `main()` code path of `fontTools.varLib`, which is used by the `fonttools varLib` CLI and any code that invokes `fontTools.varLib.main()`. Successful exploitation could allow a malicious user to write arbitrary files on the file system, potentially leading to remote code execution. The issue has been addressed in version 4.60.2.

Description: fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2.
Source: security-advisories@github.com
NVD status: Analyzed
Products: fonttools

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-91

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fonttools:fonttools:*:*:*:*:*:python:*:*",
            "vulnerable": true,
            "matchCriteriaId": "76CBDF6D-E062-4632-8E9B-027EC11860C7",
            "versionEndExcluding": "4.60.2",
            "versionStartIncluding": "4.33.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.