Google Patches Actively Exploited Android System Vulnerability in May 2025 Update

Google has addressed 46 security flaws in its May 2025 Android security updates, including a high-severity vulnerability (CVE-2025-27363) actively exploited in attacks. The flaw, a heap buffer overflow in the FreeType font rendering library (CVSS 8.1), allows local code execution without privileges. This marks the fourth zero-day patched in Android this year, underscoring persistent targeting of mobile devices.

Technical Breakdown of CVE-2025-27363

The vulnerability resides in FreeType 2.13.0, where malformed TrueType fonts trigger a heap buffer overflow during glyph loading. Attackers craft malicious variable font files (TTF/GX) to corrupt memory structures. A simplified proof-of-concept demonstrates the flaw:

// FreeType exploit (CVE-2025-27363)
FT_Error load_glyph(FT_GlyphSlot slot, FT_UInt glyph_index) {
  ...
  buffer_overflow = malicious_font_data[glyph_index]; // Heap corruption
}

Successful exploitation grants arbitrary code execution within the System component context. Google’s patch backports FreeType 2.13.1 fixes to Android 13+ devices, though OEM rollout delays remain a concern.

Impact and Affected Systems

Approximately 50% of Android devices run Android 12 or older, which reached end-of-life (EOL) in March 2025 and no longer receive security updates. This includes popular models like Pixel 3a, Galaxy S10, and OnePlus 7 series. Unpatched devices are vulnerable to:

Privilege escalation via local attacks
Forensic tool exploitation (e.g., Cellebrite spyware)
Malicious app sideloading risks

The vulnerability joins prior Android zero-days like CVE-2024-53104 (USB kernel flaw) and CVE-2024-53150 (Linux kernel bug), both linked to law enforcement tools.

Mitigation and Response

Organizations should prioritize patching via the May 2025 Android Security Bulletin. For EOL devices, consider:

Upgrading to supported hardware
Migrating to community-supported ROMs like LineageOS
Enforcing app allowlisting to block sideloading

Google Play Integrity API may block outdated OS versions from accessing sensitive apps, creating operational challenges for unpatched devices.

Conclusion

The active exploitation of CVE-2025-27363 highlights ongoing threats to mobile ecosystems, particularly for devices beyond their support lifecycle. Organizations must balance patch urgency with legacy device management, while researchers should monitor for exploit adaptations in wild.