Read the docs
TI-2025-13945 Aliases CVE-2025-15270GHSA-hp8x-4h95-9799

Improper array index validation in FontForge

Priority MEDIUM 41CWE-129Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 6 fixed, 1 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-129 and the CVSS impact.

Summary

FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0061 49th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 6 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FontForgeFontForgeaca4f524c6cb14cdc7bc4cd493492a33f5154797—No fix listedCNA
  • FontForge VendorFontForge Affected aca4f524c6cb14cdc7bc4cd493492a33f5154797 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fontforge:fontforge:2025-11-17:*:*:*:*:*:*:*2025-11-17VulnerableFontForge
  • cpe:2.3:a:fontforge:fontforge:2025-11-17:*:*:*:*:*:*:* Versions 2025-11-17 Vulnerable ·FontForge

Remediation

Red Hat 6 advisories

  • RHSA-2026:8875 Released 2026-04-20 · Red Hat rating Important
    fontforge security update
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) fontforge-20230101-15.el10_0
  • RHSA-2026:7677 Released 2026-04-13 · Red Hat rating Important
    fontforge security update
    • Red Hat Enterprise Linux CRB (v. 8) fontforge-20200314-7.el8_10
  • RHSA-2026:7001 Released 2026-04-08 · Red Hat rating Important
    fontforge security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) fontforge-20201107-7.el9_4
Show 3 more Red Hat advisories
  • RHSA-2026:6635 Released 2026-04-06 · Red Hat rating Important
    fontforge security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) fontforge-20201107-8.el9_6
  • RHSA-2026:6631 Released 2026-04-06 · Red Hat rating Important
    fontforge security update
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) fontforge-20230101-15.el10_1
  • RHSA-2026:6628 Released 2026-04-06 · Red Hat rating Important
    fontforge security update
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) fontforge-20201107-8.el9_7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:7001
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:6635
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:7677
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:6631
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:6628
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:8875
Not affected: 1 product
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-15270
  2. 2026-10-03 Alias added: GHSA-hp8x-4h95-9799

References

Advisory 1

  • TI-2025-32277 FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c. CVSS 3.1MEDIUM 6.5
  • TI-2025-32275 FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8. CVSS 3.1MEDIUM 6.5
  • TI-2019-11856 FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c. CVSS 3.0CRITICAL 9.8
  • TI-2020-04474 FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c. CVSS 3.1HIGH 8.8
  • TI-2020-04441 FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c. CVSS 3.1HIGH 8.8
  • TI-2017-12798 uiutil.c in FontForge through 20170731 does not validate strings before launching the… CVSS 3.0HIGH 8.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences