Executive brief
skia-python is a Python binding for the Skia graphics library. The Linux wheel packages include a vulnerable version of the FreeType font rendering library (CVE-2025-27363), which is bundled during the build process. An attacker with network access and specific preconditions could exploit the vulnerable FreeType code to achieve remote code execution, data theft, or service disruption on systems using affected skia-python wheels.
Technical details
The vulnerability stems from skia-python's build pipeline using a pinned version of cibuildwheel (2.21.3) that relies on outdated manylinux container images with RedHat freetype package version 2.9.1-9.el8, which contains CVE-2025-27363. During the build process, libfreetype is vendored from the system rather than being explicitly updated to the patched version 2.9.1-10, resulting in the vulnerable library being embedded in distributed wheels. The root cause is a dependency management issue: freetype is a transitive dependency not explicitly managed in the build script, allowing an outdated system package to be included. An attacker who can provide specially crafted input to applications using the affected wheels could trigger memory corruption vulnerabilities in the vendored libfreetype. The fix requires rebuilding wheels with explicit installation of the patched freetype-devel package.
Affected products
- kyamagu skia-python <=144.0
Timeline
- 2026-03-19: disclosed