Google has released its monthly security updates for May , addressing 46 different vulnerabilities in Android . Among them stands out a critical vulnerability that, according to the company, has already been used in attacks.
This is the vulnerability CVE-2025-27363, with a CVSS risk score of 8.1/10. It is a serious vulnerability in the System component, which allows malicious code to be executed locally, without requiring additional privileges or any action from the user.
See also: CISA added Langflow vulnerability to KEV Catalog
Google clarified that the vulnerability is located in the FreeType library , an open-source font rendering library. The vulnerability was first discovered by Facebook 's security team in March 2025 and has already been used in attacks. Specifically, it is an "out-of-bounds write" error that could allow code execution when processing certain TrueType font formats.
The problem has already been fixed in FreeType after 2.13.0, while Google noted that there are indications of limited and targeted exploitation of this gap — without revealing further details about the related attacks.
In addition to the above serious issue, the May Android update also fixes eight other vulnerabilities in the Android System and fifteen in the Framework module, which could be exploited to escalate privileges, access sensitive data , or destabilize the device via a denial-of-service attack (DoS).
See also: Docker vulnerability allows MacOS users to download container images
Google reminds us that newer versions of Android have been enhanced with additional protections, making it more difficult to exploit such vulnerabilities. For this reason, it recommends that all users keep their devices fully updated, if possible.
Android security updates
Regularly updating Android devices is essential. These security updates, released by Google on a monthly basis, provide critical fixes for known vulnerabilities and help protect Android users from potential attacks and exploits. It's important to keep your device up to date with the latest updates to ensure the security of your personal information.
In addition to fixing vulnerabilities, these security updates also offer improvements, making your Android experience smoother and more secure. With each update, Google aims to improve the overall performance and security of its operating system, providing a better user experience for everyone.
See also: New DslogdRAT malware is distributed via vulnerability in Ivanti Connect Secure
However, despite these efforts by Google, some Android devices may not receive timely updates for various reasons. It is important for users to check for updates regularly and consider upgrading if (replacing) their devices necessary.
Source: thehackernews.com
