Read the docs
TI-2025-13950 Aliases CVE-2025-15275GHSA-6465-93fg-6pfr

Heap-based buffer overflow in FontForge

Priority MEDIUM 41CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 7 fixed, 1 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28543.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00609 49th percentileScored 2026-11-07
Fix Partial Red Hat: 7 advisoriesRed Hat: 7 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FontForgeFontForgeaca4f524c6cb14cdc7bc4cd493492a33f5154797—No fix listedCNA
  • FontForge VendorFontForge Affected aca4f524c6cb14cdc7bc4cd493492a33f5154797 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fontforge:fontforge:2025-11-17:*:*:*:*:*:*:*2025-11-17VulnerableFontForge
  • cpe:2.3:a:fontforge:fontforge:2025-11-17:*:*:*:*:*:*:* Versions 2025-11-17 Vulnerable ·FontForge

Remediation

Red Hat 7 advisories

  • RHSA-2026:8937 Released 2026-04-20 · Red Hat rating Important
    fontforge security update
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) fontforge-20120731b-14.el7_9, fontforge-20120731b-14.el7_9.ppc, fontforge-devel-20120731b-14.el7_9 +1
  • RHSA-2026:7677 Released 2026-04-13 · Red Hat rating Important
    fontforge security update
    • Red Hat Enterprise Linux CRB (v. 8) fontforge-20200314-7.el8_10
  • RHSA-2026:2566 Released 2026-02-11 · Red Hat rating Important
    fontforge security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) fontforge-20201107-6.el9_4
Show 4 more Red Hat advisories
  • RHSA-2026:2213 Released 2026-02-09 · Red Hat rating Important
    fontforge security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) fontforge-20201107-7.el9_6
  • RHSA-2026:2230 Released 2026-02-09 · Red Hat rating Important
    fontforge security update
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) fontforge-20230101-14.el10_1
  • RHSA-2026:2232 Released 2026-02-09 · Red Hat rating Important
    fontforge security update
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) fontforge-20230101-14.el10_0
  • RHSA-2026:2039 Released 2026-02-05 · Red Hat rating Important
    fontforge security update
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) fontforge-20201107-7.el9_7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:2566
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:2213
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:7677
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:2230
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:2039
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:2232
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:8937

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-15275
  2. 2026-10-03 Alias added: GHSA-6465-93fg-6pfr

References

Advisory 1

  • TI-2025-32277 FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c. CVSS 3.1MEDIUM 6.5
  • TI-2025-32275 FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8. CVSS 3.1MEDIUM 6.5
  • TI-2019-11856 FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c. CVSS 3.0CRITICAL 9.8
  • TI-2020-04474 FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c. CVSS 3.1HIGH 8.8
  • TI-2020-04441 FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c. CVSS 3.1HIGH 8.8
  • TI-2017-12798 uiutil.c in FontForge through 20170731 does not validate strings before launching the… CVSS 3.0HIGH 8.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences