Red Hat Security Advisory

RHSA-2026:2566

fontforge security update

Released 2026-02-11 · Red Hat rating Important · View on Red Hat →

Fixed in

TI-2025-13950 CVE-2025-15275 · GHSA-6465-93fg-6pfr

MEDIUM 41

FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00609 Published 2025-12-31 Partial fix CWE-122

TI-2025-13944 CVE-2025-15269 · GHSA-8j84-3r78-7j5x

MEDIUM 41

FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00533 Published 2025-12-31 Partial fix CWE-416

TI-2025-13954 CVE-2025-15279 · GHSA-cgxg-jvf2-h7v5

LOW 36

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.00291 Published 2025-12-31 Partial fix CWE-122

TI-2024-16541 CVE-2024-25082 · GHSA-2j3h-j2q3-wxp3

LOW 33

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0187 Published 2024-02-26 Partial fix CWE-77

TI-2024-16540 CVE-2024-25081 · GHSA-rjx3-xwwm-jhj5

LOW 24

Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

CVSS 3.1MEDIUM 4.2 Local Low privileges User interaction EPSS 0.01082 Published 2024-02-26 Partial fix CWE-77