fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2.
Fix
Public exploits 6
- 4nuxd/CVE-2025-66034 PoC on GitHub
- Liquid-Sec/Variatype.htb-CVE-2025-66034 PoC on GitHub
- jwsly12/CVE-2025-66034-htb-ctf PoC on GitHub
- symphony2colour/varlib-cve-2025-66034 PoC on GitHub
- tristanqtn/CVE-2025-66034 PoC on GitHub
- v3cn4x00/POC-CVE-2025-66034 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32 Patch
- https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv Exploit, Vendor Advisory
- https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · fonttoolsNVD modified 2026-10-18 18:10
Affected (CPE criteria) 1
cpe:2.3:a:fonttools:fonttools:*:*:*:*:*:python:*:*