Vulnerability · Published Nov 29, 2025 · Assigned by GitHub_M
CVE-2025-66034fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib
Medium 6.3
In plain English
A medium-severity security flaw in fonttools from fonttools. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | fonttools | 4.38.0-1+deb12u1 | DEBIAN-CVE-2025-66034 |
| Debian:13 | fonttools | 4.57.0-1+deb13u1 | DEBIAN-CVE-2025-66034 |
| Debian:14 | fonttools | 4.61.1-1 | DEBIAN-CVE-2025-66034 |
| PyPI | fonttools | 4.60.2 | GHSA-768j-98cg-p3fv |
| PyPI | fonttools | 4.60.2 | PYSEC-2026-1389 |
| Ubuntu:25.10 | fonttools | 4.55.3-2ubuntu0.25.10.1 | USN-7917-1 |
| Ubuntu:25.10 | fonttools | 4.55.3-2ubuntu0.25.10.1 | UBUNTU-CVE-2025-66034 |
| Ubuntu:26.04:LTS | fonttools | 4.57.0-3ubuntu1 | UBUNTU-CVE-2025-66034 |
Affected products (as reported)
Weakness: CWE-91 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L