Critical Remote Code Execution Vulnerability in FontForge Package
Summary
ALSA-2026:6631: Important: fontforge security update. Affects fontforge versions < 20230101-15.el10_1. Fixed in 20230101-15.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FontForge is a widely used open-source font editor that supports various font formats, including PostScript, TrueType, OpenType, and CID-keyed fonts. It allows users to create and edit both outline and bitmap fonts, making it a versatile tool for designers and typographers. However, a recent security vulnerability has been identified that exposes users to potential remote code execution risks when parsing malicious SFD files.
Vulnerability Detail
The vulnerability, identified as CVE-2025-15270, allows an attacker to execute arbitrary code on a user's system by crafting a malicious SFD file. When this file is opened in FontForge, the software's parsing mechanism can be exploited, leading to unauthorized access and control over the affected system. This poses significant risks, especially in environments where FontForge is used to handle untrusted font files.
How To Fix
Minimum fixed version
20230101-15.el10_1
This is the first release that contains the fix.
sudo dnf update fontforgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening SFD files from untrusted sources until the software is updated. Additionally, consider using alternative font editing tools that do not have this vulnerability.
Conclusion
The identified vulnerability in FontForge poses a significant risk of remote code execution through malicious SFD files. Users are strongly advised to update to the latest patched version to secure their systems. Until the update is applied, caution should be exercised when handling font files from untrusted sources.
See every vulnerability recorded for fontforge →
FAQ
CVE-2025-15270 is a security vulnerability in FontForge that allows remote code execution through malicious SFD file parsing.
If you are using a version prior to 20230101-15.el10_1, your installation is vulnerable to this issue.
Avoid opening SFD files from untrusted sources and consider using alternative font editing software until you can update.
For detailed information, refer to the CVE page associated with CVE-2025-15270.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, ensuring real-time awareness of potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for fontforge.
