CyberSecBulletin

Fonttools vulnerabilities

We track 2 vulnerabilities in Fonttools products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 29, 2025.

2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score

Latest Fonttools vulnerabilities

  • 9.8 Critical severity

    fonttools: XML Injection

    CVE-2025-66034Fonttools

    fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malici

  • 7.5 High severity

    fonttools: Improper Restriction of XML External Entity Reference

    CVE-2023-45139FonttoolsEPSS 1.23%

    fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG ta