The advisory covers a set of vulnerabilities including CVE-2025-27363 (an out-of-bounds write in freetype when parsing TrueType GX and variable font files) and nine additional CVEs affecting libsoup, such as integer overflow (CVE-2025-32050), heap buffer overflows (CVE-2025-32052, CVE-2025-32053), out-of-bounds reads (CVE-2025-32906), denial of service via overlapping Range header requests (CVE-2025-32907), null pointer dereferences (CVE-2025-32909, CVE-2025-32910, CVE-2025-32913), and a double free vulnerability (CVE-2025-32911). These vulnerabilities affect the parsing and handling of font subglyph structures and HTTP headers, potentially leading to memory corruption or service disruption. Red Hat has released updated packages for Red Hat Enterprise Linux 8 and related variants to address these issues.

The vulnerabilities can lead to memory corruption issues such as out-of-bounds writes and heap buffer overflows, which may cause application crashes or potentially allow code execution. Null pointer dereferences and double free flaws can result in denial of service conditions. The integer overflow and out-of-bounds read issues may also cause instability or unexpected behavior in affected components. The denial of service vulnerability in libsoup can be triggered by specially crafted HTTP Range header requests. No known exploits in the wild have been reported at this time.

Red Hat has issued updated packages that fix these vulnerabilities. Users of Red Hat Enterprise Linux 8 and related products should apply the security updates referenced in advisory RHSA-2025:8292 promptly. Detailed instructions for applying the updates are available at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patches.