Avalonia.Skia using freetype ?

[Tenjim]

Hi guys,

I just need to ask something about Avalonia.Skia. I was curious if Avalonia using FreeType for avalonia.skia. If yes, do you know the version used ?

Do you know if avalonia using that for all OS ? Because, I saw that it's just concern linux in that case.

it's about this vulnerability:

CVE-2025-27363

Thanks in advance,
Tenjim

[Gillibald]

Just because there is some vulnerable API there isn't automatically some exploitable code path. SkiaSharp nor Avalonia support the affected APIs.

[Tenjim]

Cool, just wanted to know if there is an issue about it.

[Tenjim]

Additionnal infos,
I have seen that Avalonia.skia (11.2.3) use SkiaSharp 2.88.9 version.
SkiaSharp using Google/skia m88 version.
and Google/skia using 2.10.4 version of freetype.