Critical Remote Code Execution Vulnerability in FontForge Package
Summary
ALSA-2026:2039: Important: fontforge security update. Affects fontforge versions < 20201107-7.el9_7. Fixed in 20201107-7.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FontForge is a versatile font editor that supports various font formats, including PostScript, TrueType, OpenType, and CID-keyed fonts. It allows users to create and edit outline and bitmap fonts, making it a valuable tool for designers and developers. However, recent security vulnerabilities have been identified that could allow attackers to execute arbitrary code remotely, posing significant risks to users and systems utilizing this software.
Vulnerability Detail
The vulnerabilities in FontForge stem from improper handling of certain file formats, leading to severe security risks. Specifically, a heap-based buffer overflow during BMP file parsing (CVE-2025-15279), a Use-After-Free error in SFD file parsing (CVE-2025-15269), and an arbitrary code execution vulnerability due to buffer overflow in SFD file parsing (CVE-2025-15275) have been discovered. These flaws could allow an attacker to execute malicious code on a victim's machine, potentially compromising sensitive data and system integrity.
How To Fix
Minimum fixed version
20201107-7.el9_7
This is the first release that contains the fix.
sudo dnf update fontforgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted BMP or SFD files until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The identified vulnerabilities in FontForge pose significant risks, allowing for potential remote code execution. Users are strongly advised to update to the latest patched version to safeguard their systems. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for fontforge →
FAQ
FontForge is an open-source font editor that allows users to create and edit various font formats.
The main vulnerabilities include remote code execution risks due to buffer overflows and use-after-free errors in file parsing.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
As a workaround, avoid opening untrusted BMP or SFD files until you can apply the update.
For detailed information, refer to the CVE pages linked in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for fontforge.
