Critical Remote Code Execution Vulnerability in FontForge Package
Summary
ALSA-2026:2230: Important: fontforge security update. Affects fontforge versions < 20230101-14.el10_1. Fixed in 20230101-14.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FontForge is a widely used open-source font editor that supports various font formats, including PostScript, TrueType, OpenType, and CID-keyed fonts. It allows users to create and modify both outline and bitmap fonts, making it a versatile tool for designers and developers. However, recent security assessments have revealed vulnerabilities that could lead to severe security risks, including remote code execution.
Vulnerability Detail
The vulnerabilities identified in FontForge stem from improper handling of certain file formats during parsing. Specifically, a heap-based buffer overflow in BMP file parsing (CVE-2025-15279), a Use-After-Free error in SFD file parsing (CVE-2025-15269), and an arbitrary code execution vulnerability via SFD file parsing buffer overflow (CVE-2025-15275) could allow attackers to execute arbitrary code remotely. These vulnerabilities can be exploited by crafting malicious font files that, when opened in FontForge, could lead to unauthorized access and control over the affected system.
How To Fix
Minimum fixed version
20230101-14.el10_1
This is the first release that contains the fix.
sudo dnf update fontforgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted or unknown font files in FontForge until the package is updated. Additionally, implementing strict file validation and monitoring can help reduce the risk of exploitation.
Conclusion
The identified vulnerabilities in FontForge pose significant security risks, particularly the potential for remote code execution. It is crucial for users to update to the latest patched version to safeguard their systems. By following the recommended steps and utilizing tools like Vulert, users can effectively monitor and manage vulnerabilities in their software.
See every vulnerability recorded for fontforge →
FAQ
FontForge is an open-source font editor that allows users to create and edit various font formats, making it a popular tool among designers.
The main vulnerabilities include a heap-based buffer overflow, a Use-After-Free error, and an arbitrary code execution vulnerability, all related to file parsing.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, you can check for any affected packages.
If immediate updates are not possible, avoid opening untrusted font files and consider implementing file validation measures to mitigate risks.
For detailed information, refer to the CVE pages associated with the vulnerabilities: CVE-2025-15279, CVE-2025-15269, and CVE-2025-15275.
Related vulnerabilities
Recent vulnerabilities recorded for fontforge.
