Critical Remote Code Execution Vulnerability in FontForge Package
Summary
RLSA-2026:6631: Important: fontforge security update. Affects fontforge versions < 0:20230101-15.el10_1. Fixed in 0:20230101-15.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FontForge is a versatile font editor that supports various font formats, including PostScript, TrueType, OpenType, and CID-keyed fonts. It is widely used for creating and modifying both outline and bitmap fonts. However, it has been identified to have a significant security vulnerability that allows for remote code execution through the parsing of malicious SFD files.
Vulnerability Detail
The vulnerability, identified as CVE-2025-15270, allows attackers to execute arbitrary code on the system by crafting a malicious SFD file. When this file is processed by FontForge, it can lead to unauthorized access and control over the affected system. The potential ramifications include data theft, system compromise, and further exploitation of the network. The CVSS score for this vulnerability is 8.8, indicating a high level of severity.
How To Fix
Minimum fixed version
0:20230101-15.el10_1
This is the first release that contains the fix.
sudo dnf update fontforgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid opening SFD files from untrusted sources until the package is updated. This can help mitigate the risk of exploitation until a permanent fix is applied.
Conclusion
The identified vulnerability in FontForge presents a serious risk due to its ability to allow remote code execution through malicious SFD files. Users are strongly advised to update their FontForge installations to the latest patched version to protect against potential exploits. Until an update can be applied, it is crucial to avoid opening untrusted SFD files.
See every vulnerability recorded for fontforge →
FAQ
CVE-2025-15270 is a vulnerability in FontForge that allows for remote code execution via malicious SFD file parsing.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your manifest file with Vulert's playground, you can determine if your application is affected.
If an immediate update is not possible, refrain from opening SFD files from unknown or untrusted sources to minimize risk.
The vulnerability can lead to unauthorized code execution, data breaches, and system compromise, posing significant risks to users and organizations.
For detailed information, refer to the CVE page associated with CVE-2025-15270, which outlines the security issue, its impact, and mitigation strategies.
Related vulnerabilities
Recent vulnerabilities recorded for fontforge.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.