Critical Remote Code Execution Vulnerabilities in FontForge Package
Summary
RLSA-2026:2230: Important: fontforge security update. Affects fontforge versions < 0:20230101-14.el10_1. Fixed in 0:20230101-14.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
FontForge is a widely used open-source font editor that supports various font formats, including PostScript, TrueType, and OpenType. It is designed for both outline and bitmap fonts, making it a versatile tool for font creation and editing. However, recent security assessments have revealed significant vulnerabilities that could allow attackers to execute arbitrary code remotely, posing a serious risk to users and systems utilizing this software.
Vulnerability Detail
The vulnerabilities in FontForge stem from improper handling of specific file formats during parsing. Notably, a heap-based buffer overflow in BMP file parsing (CVE-2025-15279) and a Use-After-Free condition in SFD file parsing (CVE-2025-15269) can lead to remote code execution. Additionally, an arbitrary code execution vulnerability due to buffer overflow in SFD file parsing (CVE-2025-15275) has been identified. These vulnerabilities can be exploited by attackers to execute malicious code on the affected systems, potentially leading to unauthorized access and data breaches.
How To Fix
Minimum fixed version
0:20230101-14.el10_1
This is the first release that contains the fix.
sudo dnf update fontforgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted BMP or SFD files with FontForge until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The identified vulnerabilities in FontForge pose significant risks, including remote code execution through improper file handling. Users are strongly encouraged to update to the latest patched version to safeguard their systems. Additionally, employing Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for fontforge →
FAQ
The CVSS score for the vulnerabilities in FontForge is 8.8, indicating a high level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without any signup.
The vulnerabilities are primarily associated with BMP and SFD file formats, which are commonly used in font editing.
Yes, if exploited, these vulnerabilities can lead to unauthorized access and potential data breaches, which may result in data loss.
If immediate updates are not possible, avoid opening untrusted BMP or SFD files until the package is updated to minimize risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for fontforge.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
