CVE-2025-15269

A flaw was found in FontForge. This use-after-free vulnerability, occurring during the parsing of SFD (Spline Font Database) files, allows a remote attacker to execute arbitrary code. Successful exploitation requires user interaction, such as opening a specially crafted malicious file or visiting a malicious web page. This can lead to complete control over the affected system.

This vulnerability is rated Important for Red Hat because it allows remote code execution in FontForge through a use-after-free flaw when parsing specially crafted SFD files. Successful exploitation requires user interaction, such as opening a malicious file or visiting a malicious web page. This affects FontForge as shipped in Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10, as well as Fedora and Red Hat In-Vehicle OS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid opening untrusted SFD files or visiting malicious web pages. Exercise caution with content from unknown or suspicious sources to prevent exploitation of this vulnerability.