CVE-2025-15277

A flaw was found in FontForge. This vulnerability, a heap-based buffer overflow, allows a remote attacker to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious SGI (Silicon Graphics Image) file, which triggers improper data length validation during scanline parsing, leading to memory corruption.

This vulnerability is rated Important for Red Hat products. Exploitation requires user interaction, specifically opening a specially crafted SGI file in FontForge. This impacts systems where FontForge is installed and used to process untrusted image files, such as in desktop environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid opening untrusted SGI (Silicon Graphics Image) files with FontForge. If FontForge is not essential for system operation, consider removing the package to eliminate the attack surface.

To remove FontForge: For Red Hat Enterprise Linux 7 and 8: sudo yum remove fontforge For Red Hat Enterprise Linux 9 and 10, and Fedora: sudo dnf remove fontforge

Removing FontForge may affect other applications that depend on its functionality. A system restart may be required to ensure all related processes are terminated.