CVE-2025-15278

A flaw was found in FontForge. This integer overflow vulnerability, located in the parsing of pixels within XBM (X BitMap) files, allows a remote attacker to execute arbitrary code. The issue arises from insufficient validation of user-supplied data, which can lead to an integer overflow before memory allocation. Successful exploitation requires user interaction, such as opening a malicious XBM file, and results in arbitrary code execution in the context of the current process.

This vulnerability is rated Important for Red Hat products as it allows remote code execution in FontForge due to an integer overflow when parsing XBM files. Exploitation requires user interaction, where a target must open a malicious XBM file. This affects FontForge across various Red Hat Enterprise Linux versions and Fedora.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid opening untrusted XBM files with FontForge. If FontForge is not required, consider removing the fontforge package to eliminate the attack vector. For Red Hat Enterprise Linux systems, this can be achieved by running sudo dnf remove fontforge or sudo yum remove fontforge depending on the version. Removing this package may impact functionality that relies on FontForge.