CVE-2024-25081
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
- Record
CVE-2024-25081- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2024-22443
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
- Record
EUVD-2024-22443- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rjx3-xwwm-jhj5
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
- Record
GHSA-rjx3-xwwm-jhj5- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-77
- Updated
- 2026-11-02
NVD
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
- Record
CVE-2024-25081- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
- Record
CVE-2024-25081- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-25081
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
- Record
DEBIAN-CVE-2024-25081- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 14 moreShow less
OSVOESA-2024-1228
fontforge security update
FontForge (former PfaEdit) is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.
Security Fix(es):
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.(CVE-2024-25081)
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.(CVE-2024-25082)
- Record
OESA-2024-1228- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2024:4267
Red Hat Security Advisory: fontforge security update
- Record
RHSA-2024:4267- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2024:9439
Red Hat Security Advisory: fontforge security update
- Record
RHSA-2024:9439- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2026:2566
Red Hat Security Advisory: fontforge security update
- Record
RHSA-2026:2566- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2024:4267
Moderate: fontforge security update
FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.
Security Fix(es):
-
fontforge: command injection via crafted filenames (CVE-2024-25081)
-
fontforge: command injection via crafted archives or compressed files (CVE-2024-25082)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2024:4267- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRLSA-2024:9439
Moderate: fontforge security update
FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.
Security Fix(es):
-
fontforge: command injection via crafted archives or compressed files (CVE-2024-25082)
-
fontforge: command injection via crafted filenames (CVE-2024-25081)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.
- Record
RLSA-2024:9439- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-25081
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
- Record
UBUNTU-CVE-2024-25081- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVALSA-2024:4267 No score
Moderate: fontforge security update
FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.
Security Fix(es):
- fontforge: command injection via crafted filenames (CVE-2024-25081)
- fontforge: command injection via crafted archives or compressed files (CVE-2024-25082)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2024:4267- Updated
- 2026-11-02
OSVALSA-2024:9439 No score
Moderate: fontforge security update
FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.
Security Fix(es):
- fontforge: command injection via crafted archives or compressed files (CVE-2024-25082)
- fontforge: command injection via crafted filenames (CVE-2024-25081)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2024:9439- Updated
- 2026-11-02
OSVMGASA-2024-0082 No score
Updated fontforge packages fix security vulnerabilities
Splinefont in FontForge through 20230101 allows command injection via crafted filenames. (CVE-2024-25081) Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. (CVE-2024-25082)
- Record
MGASA-2024-0082- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13755-1 No score
fontforge-20230101-4.1 on GA media
These are all security issues fixed in the fontforge-20230101-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13755-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0863-1 No score
Security update for fontforge
This update for fontforge fixes the following issues:
- CVE-2024-25081: Fixed command injection via crafted filenames (bsc#1220404).
- CVE-2024-25082: Fixed command injection via crafted archives or compressed files (bsc#1220405).
- Record
SUSE-SU-2024:0863-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0864-1 No score
Security update for fontforge
This update for fontforge fixes the following issues:
- CVE-2024-25081: Fixed command injection via crafted filenames (bsc#1220404).
- CVE-2024-25082: Fixed command injection via crafted archives or compressed files (bsc#1220405).
- Record
SUSE-SU-2024:0864-1- Updated
- 2026-11-02
OSVUSN-6856-1 No score
fontforge vulnerabilities
It was discovered that FontForge incorrectly handled filenames. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform a command injection. (CVE-2024-25081)
It was discovered that FontForge incorrectly handled archives and compressed files. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform command injection. (CVE-2024-25082)
- Record
USN-6856-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fontforgeAlmaLinux:8 From an advisory covering 2 CVEs |
before 20200314-6.el8_10 | 20200314-6.el8_10 |
fontforgeAlmaLinux:9 From an advisory covering 2 CVEs |
before 20201107-6.el9 | 20201107-6.el9 |
fontforgeDebian:12 |
before 1:20230101~dfsg-1.1~deb12u1, plus listed versions 1:20230101~dfsg-1 |
1:20230101~dfsg-1.1~deb12u1 |
fontforgeDebian:13 |
before 1:20230101~dfsg-1.1 | 1:20230101~dfsg-1.1 |
fontforgeDebian:14 |
before 1:20230101~dfsg-1.1 | 1:20230101~dfsg-1.1 |
fontforgeDebian:10 From an advisory covering 4 CVEs |
before 1:20170731~dfsg-1+deb10u1, plus listed versions 1:20170731~dfsg-1 |
1:20170731~dfsg-1+deb10u1 |
fontforgeDebian:11 From an advisory covering 2 CVEs |
before 1:20201107~dfsg-4+deb11u1, plus listed versions 1:20201107~dfsg-4 |
1:20201107~dfsg-4+deb11u1 |
fontforgeDebian:12 From an advisory covering 2 CVEs |
before 1:20230101~dfsg-1.1~deb12u1, plus listed versions 1:20230101~dfsg-1 |
1:20230101~dfsg-1.1~deb12u1 |
fontforgeMageia:9 From an advisory covering 2 CVEs |
before 20220308-2.1.mga9 | 20220308-2.1.mga9 |
fontforgeopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 20200314-5.oe1 | 20200314-5.oe1 |
Show 38 moreShow less
| Package | Affected | Fixed |
|---|---|---|
fontforgeopenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 20200314-5.oe2003sp4 | 20200314-5.oe2003sp4 |
fontforgeopenEuler:22.03-LTS From an advisory covering 2 CVEs |
before 20200314-8.oe2203sp3 | 20200314-8.oe2203sp3 |
fontforgeopenEuler:22.03-LTS-SP1 From an advisory covering 2 CVEs |
before 20200314-8.oe2203sp1 | 20200314-8.oe2203sp1 |
fontforgeopenEuler:22.03-LTS-SP2 From an advisory covering 2 CVEs |
before 20200314-8.oe2203sp2 | 20200314-8.oe2203sp2 |
fontforgeopenEuler:22.03-LTS-SP3 From an advisory covering 2 CVEs |
before 20200314-8.oe2203sp3 | 20200314-8.oe2203sp3 |
fontforgeRed Hat:enterprise_linux:8::crb From an advisory covering 2 CVEs |
before 0:20200314-6.el8_10 | 0:20200314-6.el8_10 |
fontforge-debuginfoRed Hat:enterprise_linux:8::crb From an advisory covering 2 CVEs |
before 0:20200314-6.el8_10 | 0:20200314-6.el8_10 |
fontforge-debugsourceRed Hat:enterprise_linux:8::crb From an advisory covering 2 CVEs |
before 0:20200314-6.el8_10 | 0:20200314-6.el8_10 |
fontforgeRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:20201107-6.el9 | 0:20201107-6.el9 |
fontforge-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:20201107-6.el9 | 0:20201107-6.el9 |
fontforge-debugsourceRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:20201107-6.el9 | 0:20201107-6.el9 |
fontforgeRed Hat:rhel_eus:9.4::crb From an advisory covering 5 CVEs |
before 0:20201107-6.el9_4 | 0:20201107-6.el9_4 |
fontforge-debuginfoRed Hat:rhel_eus:9.4::crb From an advisory covering 5 CVEs |
before 0:20201107-6.el9_4 | 0:20201107-6.el9_4 |
fontforge-debugsourceRed Hat:rhel_eus:9.4::crb From an advisory covering 5 CVEs |
before 0:20201107-6.el9_4 | 0:20201107-6.el9_4 |
fontforgeRocky Linux:8 From an advisory covering 2 CVEs |
before 0:20200314-6.el8_10 | 0:20200314-6.el8_10 |
fontforgeRocky Linux:9 From an advisory covering 2 CVEs |
before 0:20201107-6.el9 | 0:20201107-6.el9 |
fontforgeSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 2 CVEs |
before 20170731-11.17.1 | 20170731-11.17.1 |
fontforgeSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeSUSE:Enterprise Storage 7.1 From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeopenSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 20200314-150200.3.6.1 | 20200314-150200.3.6.1 |
fontforgeUbuntu:Pro:16.04:LTS |
before 20120731.b-7.1ubuntu0.1+esm1, plus listed versions 20120731.b-520120731.b-5ubuntu120120731.b-7.120120731.b-7.1ubuntu0.1 |
20120731.b-7.1ubuntu0.1+esm1 |
fontforgeUbuntu:Pro:18.04:LTS |
before 1:20170731~dfsg-1ubuntu0.1~esm1, plus listed versions 1:20161005~dfsg-4+deb9u1ubuntu11:20170731~dfsg-1 |
1:20170731~dfsg-1ubuntu0.1~esm1 |
fontforgeUbuntu:20.04:LTS |
before 1:20190801~dfsg-4ubuntu0.1, plus listed versions 1:20170731~dfsg-1build11:20170731~dfsg-21:20190801~dfsg-21:20190801~dfsg-2ubuntu11:20190801~dfsg-4 |
1:20190801~dfsg-4ubuntu0.1 |
fontforgeUbuntu:22.04:LTS |
before 1:20201107~dfsg-4+deb11u1build0.22.04.1, plus listed versions 1:20201107~dfsg-41:20201107~dfsg-4build1 |
1:20201107~dfsg-4+deb11u1build0.22.04.1 |
fontforgeUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 20120731.b-7.1ubuntu0.1+esm1, plus listed versions 20120731.b-520120731.b-5ubuntu120120731.b-7.120120731.b-7.1ubuntu0.1 |
20120731.b-7.1ubuntu0.1+esm1 |
fontforgeUbuntu:Pro:18.04:LTS From an advisory covering 2 CVEs |
before 1:20170731~dfsg-1ubuntu0.1~esm1, plus listed versions 1:20161005~dfsg-4+deb9u1ubuntu11:20170731~dfsg-1 |
1:20170731~dfsg-1ubuntu0.1~esm1 |
fontforgeUbuntu:20.04:LTS From an advisory covering 2 CVEs |
before 1:20190801~dfsg-4ubuntu0.1, plus listed versions 1:20170731~dfsg-1build11:20170731~dfsg-21:20190801~dfsg-21:20190801~dfsg-2ubuntu11:20190801~dfsg-4 |
1:20190801~dfsg-4ubuntu0.1 |
fontforgeUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 1:20201107~dfsg-4+deb11u1build0.22.04.1, plus listed versions 1:20201107~dfsg-41:20201107~dfsg-4build1 |
1:20201107~dfsg-4+deb11u1build0.22.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | InzegoSec/CVE-2024-25081_2025-47273 | 2026-03-19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-25081 is a medium vulnerability (CVSS 4.2) in Fontforge, published February 26, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in fontforge 1:20230101~dfsg-1.1~deb12u1.
References
fontforge.org/en-US/downloads
github.com/fontforge/fontforge/pull/5367
lists.debian.org/debian-lts-announce/2024/03/msg00007.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH
openwall.com/lists/oss-security/2024/03/08/2
Show 53 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-25081
access.redhat.com/errata/RHSA-2024:4267
bugzilla.redhat.com/2266180
errata.almalinux.org/8/ALSA-2024-4267.html
security-tracker.debian.org/tracker/CVE-2024-25081
advisories.mageia.org/MGASA-2024-0082.html
bugs.mageia.org/show_bug.cgi?id=32956
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1228
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4267.json
cve.org/CVERecord?id=CVE-2024-25081
docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index
zerodayinitiative.com/advisories/ZDI-25-1195
errata.rockylinux.org/RLSA-2024:4267
suse.com/support/update/announcement/2024/suse-su-20240863-1
bugzilla.suse.com/1220404
ubuntu.com/security/CVE-2024-25081