CVE-2025-15271

A flaw was found in FontForge. This vulnerability allows a remote attacker to execute arbitrary code on affected installations. Exploitation requires user interaction, such as opening a malicious SFD (Spline Font Database) file. The issue arises from improper validation of user-supplied data during SFD file parsing, which can lead to a write past the end of an allocated memory array, enabling arbitrary code execution in the context of the current user.

This vulnerability is rated Important for Red Hat products as it allows for remote code execution in FontForge. Exploitation requires user interaction, specifically opening a specially crafted SFD file. This affects FontForge as shipped in Red Hat Enterprise Linux 6 ELS, 7 ELS, 8, 9, 10, Fedora, and Red Hat In-Vehicle OS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should exercise caution when handling SFD (Spline Font Database) files from untrusted sources. Avoid opening SFD files from unknown or suspicious origins. If FontForge is not actively used, consider removing the fontforge package to eliminate the attack surface. This can be done using sudo dnf remove fontforge on Red Hat Enterprise Linux 8, 9, 10, and Fedora, or sudo yum remove fontforge on Red Hat Enterprise Linux 6 ELS and 7 ELS. Removing this package will remove FontForge functionality.