Critical Remote Code Execution Vulnerability in FontForge Package
Summary
ALSA-2026:6628: Important: fontforge security update. Affects fontforge versions < 20201107-8.el9_7. Fixed in 20201107-8.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FontForge is a powerful open-source font editor that supports a variety of font formats, including PostScript, TrueType, OpenType, and CID-keyed fonts. It is widely used for creating and editing both outline and bitmap fonts. However, a recent security issue has been identified that exposes users to potential remote code execution risks when parsing malicious SFD files.
Vulnerability Detail
The vulnerability, identified as CVE-2025-15270, allows an attacker to execute arbitrary code on a victim's system by crafting a malicious SFD file. When this file is opened in FontForge, the application may process the malicious content, leading to unauthorized access and control over the affected system. This vulnerability poses significant risks, especially in environments where FontForge is used to handle untrusted font files.
How To Fix
Minimum fixed version
20201107-8.el9_7
This is the first release that contains the fix.
sudo dnf update fontforgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid opening SFD files from untrusted sources until the package is updated. Additionally, consider using alternative font editing tools that do not have this vulnerability.
Conclusion
The identified vulnerability in FontForge poses a significant risk of remote code execution through malicious SFD files. Users are strongly encouraged to update to the latest patched version to safeguard their systems. Additionally, practicing caution with untrusted files can help mitigate risks until updates are applied.
See every vulnerability recorded for fontforge →
FAQ
CVE-2025-15270 is a security vulnerability in FontForge that allows remote code execution through malicious SFD file parsing.
If you are using a version of FontForge prior to 20201107-8.el9_7, your installation is vulnerable to this issue.
If an immediate update is not possible, avoid opening SFD files from untrusted sources and consider using alternative software.
For detailed information, refer to the CVE page associated with CVE-2025-15270.
Vulert monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json, providing real-time alerts without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for fontforge.
