Read the docs
TI-2020-15706 Aliases CVE-2020-25690GHSA-8m73-qxc4-m26m

Memory corruption in fontforge

Priority MEDIUM 41CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Why it matters now

EPSS 0.01343 71st percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—fontforgefontforge before 20200314—No fix listedCNA
  • fontforge Vendor— Affected fontforge before 20200314 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fontforge:fontforge:*:*:*:*:*:*:*:*before 20200314VulnerableFontForge
  • cpe:2.3:a:fontforge:fontforge:*:*:*:*:*:*:*:* Versions before 20200314 Vulnerable ·FontForge

Remediation

Red Hat 1 advisory

  • RHSA-2020:4844 Released 2020-11-04 · Red Hat rating Moderate
    fontforge security update
    • Red Hat CodeReady Linux Builder (v. 8) fontforge-20170731-15.el8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2020:4844
Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-25690
  2. 2026-10-03 Alias added: GHSA-8m73-qxc4-m26m

References

Patch 1

  • TI-2025-32277 FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c. CVSS 3.1MEDIUM 6.5
  • TI-2025-32275 FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8. CVSS 3.1MEDIUM 6.5
  • TI-2019-11856 FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c. CVSS 3.0CRITICAL 9.8
  • TI-2020-04474 FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c. CVSS 3.1HIGH 8.8
  • TI-2020-04441 FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c. CVSS 3.1HIGH 8.8
  • TI-2017-12798 uiutil.c in FontForge through 20170731 does not validate strings before launching the… CVSS 3.0HIGH 8.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences