Skip to content

CVE-2025-15279

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

7.8 High

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of pixels within BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27517.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.29%Up 0.2 points since Dec 31, 2025

What each source reports

CVE List Score used 7.8

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of pixels within BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27517.

Record: CVE-2025-15279
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-122
Updated: 2026-11-02

EUVDEUVD-2025-205887 7.8

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of pixels within BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27517.

Record: EUVD-2025-205887
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cgxg-jvf2-h7v5 7.8

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability....

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of pixels within BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27517.

Record: GHSA-cgxg-jvf2-h7v5
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-122
Updated: 2026-11-02

NVD 7.8

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of pixels within BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27517.

Record: CVE-2025-15279
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-122
Updated: 2026-11-02

OSV 7.8

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of pixels within BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27517.

Record: CVE-2025-15279
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-122
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-15279 7.8

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of pixels within BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27517.

Record: DEBIAN-CVE-2025-15279
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 19 moreShow less

OSVRHSA-2026:2039 8.8

Red Hat Security Advisory: fontforge security update

Record: RHSA-2026:2039
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:2213 8.8

Red Hat Security Advisory: fontforge security update

Record: RHSA-2026:2213
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:2230 8.8

Red Hat Security Advisory: fontforge security update

Record: RHSA-2026:2230
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:2232 8.8

Red Hat Security Advisory: fontforge security update

Record: RHSA-2026:2232
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:2566 8.8

Red Hat Security Advisory: fontforge security update

Record: RHSA-2026:2566
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:7677 8.8

Red Hat Security Advisory: fontforge security update

Record: RHSA-2026:7677
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:8937 8.8

Red Hat Security Advisory: fontforge security update

Record: RHSA-2026:8937
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:2039 8.8

Important: fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.

Security Fix(es):

fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279)
fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269)
fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:2039
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:2230 8.8

Important: fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.

Security Fix(es):

fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279)
fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269)
fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:2230
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:7677 8.8

Important: fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.

Security Fix(es):

fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279)
fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269)
fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275)
fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:7677
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-15279 7.8

FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of pixels within BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27517.

Record: UBUNTU-CVE-2025-15279
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2026:2039 No score

Important: fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.

Security Fix(es):

fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279)
fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269)
fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:2039
Updated: 2026-11-02

OSVALSA-2026:2230 No score

Important: fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.

Security Fix(es):

fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279)
fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269)
fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:2230
Updated: 2026-11-02

OSVALSA-2026:7677 No score

Important: fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.

Security Fix(es):

fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279)
fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269)
fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275)
fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:7677
Updated: 2026-11-02

OSVMGASA-2026-0034 No score

Updated fontforge packages fix security vulnerabilities

FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. (CVE-2025-15269) FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. (CVE-2025-15270) FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2025-15275) FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2025-15279)

Record: MGASA-2026-0034
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10122-1 No score

fontforge-20251009-4.1 on GA media

These are all security issues fixed in the fontforge-20251009-4.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10122-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20235-1 No score

Security update for fontforge

This update for fontforge fixes the following issues:

Update to version 20251009.

Security issues fixed:

CVE-2025-15279: remote code execution via heap-based buffer overflow in BMP file parsing (bsc#1256013).
CVE-2025-15269: remote code execution via use-after-free in SFD file parsing (bsc#1256032).
CVE-2025-15275: arbitrary code execution via SFD file parsing buffer overflow (bsc#1256025).
CVE-2025-50949: memory leak in function DlgCreate8 (bsc#1252652).

Other updates and bugfixes:

fix multiple crashes in Multiple Masters.
fix crash for content over 32767 characters in GDraw multiline text field.
fix crash on Up/Down
fix crash in Metrics View.
fix UFO crash for empty contours.
fix crash issue in allmarkglyphs.
Version update to 20251009:
- Update documentation for py scripts (#5180)
- Update GitHub CI runners (#5328)
- Update po files from Croudin sources. (#5330)
- Use consistent Python in MacOS GitHub runner (#5331)
- Fix CI for Windows GitHub runner (#5335)
- Fix lookup flags parsing (#5338)
- Fixes (#5332): glyph file names uXXXXX (#5333)
- make harmonization robust and avoid zero handles after harmonization (#5262)
- Quiet strict prototypes warnings. (#5313)
- Fix crash in parsegvar() due to insufficient buffer (#5339)
- Handle failed iconv conversion. Unhandled execution path was UB, causing a segfault for me (#5329)
- Fix CMake function _get_git_version() (#5342)
- Don't require individual tuple encapsulation in fontforge.font.bitmapSizes setter (#5138)
- nltransform of anchor points (#5345)
- Fix generateFontPostHook being called instead of generateFontPreHook (#5226)
- Always set usDefaultChar to 0 (.notdef) (#5242)
- add font attributes, method to Python docs (#5353)
- fix segfault triggered by Python del c[i:j] (#5352)
- Autoselect internal WOFF2 format (#5346)
- Fix typos in the FAQ (#5355)
- add font.style_set_names attribute to Python API (#5354)
- Bulk tester (#5365)
- Fix Splinefont shell invocation (#5367)
- Fix the lists of Windows language IDs (#5359)
- Support suplementary planes in SFD (emojis etc.) (#5364)
- Remove psaltnames for multi-code-point names (#5305)
- doc: added missing sudo to installation instructions (#5300)
- Fix data corruption on SFD reading (#5380)
- Compare vertical metrics check when generating TTC (#5372)
- Treat FT_PIXEL_MODE_MONO as 2 grey levels (#5379)
- Don't attempt to copy anchors into NULL font (#5405)
- Fix export of supplementary plane characters in font name to TTF (#5396)
- Defer crowdin update to the end of the pipeline (#5409)
- Fix generated feature file bugs (#5384)
- crowdin: update to java 17 (#5447)
- Remove assert from Python script processor (#5410)
- Use sysconfig for Python module locations (#5423)
- Use PyConfig API on Python 3.8 (#5404)
- Fix resource leak in unParseTTInstrs (#5476)
- Only install GUI-specific files if ENABLE_GUI is set (#5451)
- add math device tables to Python API (#5348)
- Update CI runner to macOS 13 (#5482)
- Allow hyphen and special characters in Feature File glyph names (#5358)
- Fix Python font.appendSFNTName() function (#5494)
- Update mm.c (#5386)
- Warning rollup (probably some hidden bugs!) from clang trunk (#5492)
- Fix function PyFFFont_addSmallCaps. (#5519)
- Make SmallCaps() create symbols (#5517)
- Segfault fix and complete implementation of "Don't generate FFTM tables" (#5509)
- Modernize fixed pitch flag computation (#5506)
- fix memleak in function utf7toutf8_copy (#5495)
- Avoid crashes in Python scripts when objects are accessed in invalid state (#5483)
- Fix CI for Ubuntu 24 (#5531)
- Bump GitHub CI runner to Ubuntu 22 (#5551)
- Fix memory corruption in SFUnicodeRanges() (#5537)
- Add contour draw option to H.Metrics. (#5496)
- Fix scaling of references in CharView (#5558)
- Fix TTF validation on load for fixed pitch fonts (#5562)
- Performance fixes for GSUB/GPOS dumps…

Record: openSUSE-SU-2026:20235-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20435-1 No score

Security update for fontforge

This update for fontforge fixes the following issues:

Update to version 20251009.

Security issues fixed:

CVE-2025-15279: remote code execution via heap-based buffer overflow in BMP file parsing (bsc#1256013).
CVE-2025-15269: remote code execution via use-after-free in SFD file parsing (bsc#1256032).
CVE-2025-15275: arbitrary code execution via SFD file parsing buffer overflow (bsc#1256025).
CVE-2025-50949: memory leak in function DlgCreate8 (bsc#1252652).

Other updates and bugfixes:

fix multiple crashes in Multiple Masters.
fix crash for content over 32767 characters in GDraw multiline text field.
fix crash on Up/Down
fix crash in Metrics View.
fix UFO crash for empty contours.
fix crash issue in allmarkglyphs.
Version update to 20251009:
- Update documentation for py scripts (#5180)
- Update GitHub CI runners (#5328)
- Update po files from Croudin sources. (#5330)
- Use consistent Python in MacOS GitHub runner (#5331)
- Fix CI for Windows GitHub runner (#5335)
- Fix lookup flags parsing (#5338)
- Fixes (#5332): glyph file names uXXXXX (#5333)
- make harmonization robust and avoid zero handles after harmonization (#5262)
- Quiet strict prototypes warnings. (#5313)
- Fix crash in parsegvar() due to insufficient buffer (#5339)
- Handle failed iconv conversion. Unhandled execution path was UB, causing a segfault for me (#5329)
- Fix CMake function _get_git_version() (#5342)
- Don't require individual tuple encapsulation in fontforge.font.bitmapSizes setter (#5138)
- nltransform of anchor points (#5345)
- Fix generateFontPostHook being called instead of generateFontPreHook (#5226)
- Always set usDefaultChar to 0 (.notdef) (#5242)
- add font attributes, method to Python docs (#5353)
- fix segfault triggered by Python del c[i:j] (#5352)
- Autoselect internal WOFF2 format (#5346)
- Fix typos in the FAQ (#5355)
- add font.style_set_names attribute to Python API (#5354)
- Bulk tester (#5365)
- Fix Splinefont shell invocation (#5367)
- Fix the lists of Windows language IDs (#5359)
- Support suplementary planes in SFD (emojis etc.) (#5364)
- Remove psaltnames for multi-code-point names (#5305)
- doc: added missing sudo to installation instructions (#5300)
- Fix data corruption on SFD reading (#5380)
- Compare vertical metrics check when generating TTC (#5372)
- Treat FT_PIXEL_MODE_MONO as 2 grey levels (#5379)
- Don't attempt to copy anchors into NULL font (#5405)
- Fix export of supplementary plane characters in font name to TTF (#5396)
- Defer crowdin update to the end of the pipeline (#5409)
- Fix generated feature file bugs (#5384)
- crowdin: update to java 17 (#5447)
- Remove assert from Python script processor (#5410)
- Use sysconfig for Python module locations (#5423)
- Use PyConfig API on Python 3.8 (#5404)
- Fix resource leak in unParseTTInstrs (#5476)
- Only install GUI-specific files if ENABLE_GUI is set (#5451)
- add math device tables to Python API (#5348)
- Update CI runner to macOS 13 (#5482)
- Allow hyphen and special characters in Feature File glyph names (#5358)
- Fix Python font.appendSFNTName() function (#5494)
- Update mm.c (#5386)
- Warning rollup (probably some hidden bugs!) from clang trunk (#5492)
- Fix function PyFFFont_addSmallCaps. (#5519)
- Make SmallCaps() create symbols (#5517)
- Segfault fix and complete implementation of "Don't generate FFTM tables" (#5509)
- Modernize fixed pitch flag computation (#5506)
- fix memleak in function utf7toutf8_copy (#5495)
- Avoid crashes in Python scripts when objects are accessed in invalid state (#5483)
- Fix CI for Ubuntu 24 (#5531)
- Bump GitHub CI runner to Ubuntu 22 (#5551)
- Fix memory corruption in SFUnicodeRanges() (#5537)
- Add contour draw option to H.Metrics. (#5496)
- Fix scaling of references in CharView (#5558)
- Fix TTF validation on load for fixed pitch fonts (#5562)
- Performance fixes for GSUB/GPOS dumps…

Record: SUSE-SU-2026:20435-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2739-1 No score

Security update for fontforge

This update for fontforge fixes the following issues

CVE-2025-15269: Remote Code Execution via Use-After-Free in SFD file parsing (bsc#1256032).
CVE-2025-15275: Arbitrary code execution via SFD file parsing buffer overflow (bsc#1256025).
CVE-2025-15279: Remote Code Execution via heap-based buffer overflow in BMP file parsing (bsc#1256013).

Record: SUSE-SU-2026:2739-1
Updated: 2026-11-02

Affected products

fontforge

Affected packages

Affected packages
Package	Affected	Fixed
`fontforge` AlmaLinux:9 From an advisory covering 3 CVEs	before 20201107-7.el9_7	20201107-7.el9_7
`fontforge` AlmaLinux:10 From an advisory covering 3 CVEs	before 20230101-14.el10_1	20230101-14.el10_1
`fontforge` AlmaLinux:8 From an advisory covering 4 CVEs	before 20200314-7.el8_10	20200314-7.el8_10
`fontforge` Debian:12	All versions, plus listed versions 1:20230101~dfsg-11:20230101~dfsg-1.11:20230101~dfsg-1.1~deb12u11:20230101~dfsg-21:20230101~dfsg-3 Show 8 moreShow less 1:20230101~dfsg-41:20230101~dfsg-51:20230101~dfsg-61:20230101~dfsg-71:20230101~dfsg-81:20230101~dfsg-91:20251009+git20260808~dfsg-11:20251009+git20260808~dfsg-2	None known
`fontforge` Debian:13	All versions, plus listed versions 1:20230101~dfsg-41:20230101~dfsg-51:20230101~dfsg-61:20230101~dfsg-71:20230101~dfsg-81:20230101~dfsg-91:20251009+git20260808~dfsg-11:20251009+git20260808~dfsg-2	None known
`fontforge` Debian:14	All versions, plus listed versions 1:20230101~dfsg-41:20230101~dfsg-51:20230101~dfsg-61:20230101~dfsg-71:20230101~dfsg-81:20230101~dfsg-91:20251009+git20260808~dfsg-11:20251009+git20260808~dfsg-2	None known
`fontforge` Mageia:9 From an advisory covering 4 CVEs	before 20220308-2.2.mga9	20220308-2.2.mga9
`fontforge` Red Hat:enterprise_linux:9::crb From an advisory covering 3 CVEs	before 0:20201107-7.el9_7	0:20201107-7.el9_7
`fontforge-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 3 CVEs	before 0:20201107-7.el9_7	0:20201107-7.el9_7
`fontforge-debugsource` Red Hat:enterprise_linux:9::crb From an advisory covering 3 CVEs	before 0:20201107-7.el9_7	0:20201107-7.el9_7

Show 44 moreShow less

Affected packages
Package	Affected	Fixed
`fontforge` Red Hat:rhel_eus:9.6::crb From an advisory covering 3 CVEs	before 0:20201107-7.el9_6	0:20201107-7.el9_6
`fontforge-debuginfo` Red Hat:rhel_eus:9.6::crb From an advisory covering 3 CVEs	before 0:20201107-7.el9_6	0:20201107-7.el9_6
`fontforge-debugsource` Red Hat:rhel_eus:9.6::crb From an advisory covering 3 CVEs	before 0:20201107-7.el9_6	0:20201107-7.el9_6
`fontforge` Red Hat:enterprise_linux:10.1 From an advisory covering 3 CVEs	before 0:20230101-14.el10_1	0:20230101-14.el10_1
`fontforge-debuginfo` Red Hat:enterprise_linux:10.1 From an advisory covering 3 CVEs	before 0:20230101-14.el10_1	0:20230101-14.el10_1
`fontforge-debugsource` Red Hat:enterprise_linux:10.1 From an advisory covering 3 CVEs	before 0:20230101-14.el10_1	0:20230101-14.el10_1
`fontforge` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 3 CVEs	before 0:20230101-14.el10_0	0:20230101-14.el10_0
`fontforge-debuginfo` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 3 CVEs	before 0:20230101-14.el10_0	0:20230101-14.el10_0
`fontforge-debugsource` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 3 CVEs	before 0:20230101-14.el10_0	0:20230101-14.el10_0
`fontforge` Red Hat:rhel_eus:9.4::crb From an advisory covering 5 CVEs	before 0:20201107-6.el9_4	0:20201107-6.el9_4
`fontforge-debuginfo` Red Hat:rhel_eus:9.4::crb From an advisory covering 5 CVEs	before 0:20201107-6.el9_4	0:20201107-6.el9_4
`fontforge-debugsource` Red Hat:rhel_eus:9.4::crb From an advisory covering 5 CVEs	before 0:20201107-6.el9_4	0:20201107-6.el9_4
`fontforge` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:20200314-7.el8_10	0:20200314-7.el8_10
`fontforge-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:20200314-7.el8_10	0:20200314-7.el8_10
`fontforge-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:20200314-7.el8_10	0:20200314-7.el8_10
`fontforge` Red Hat:rhel_els:7 From an advisory covering 3 CVEs	before 0:20120731b-14.el7_9	0:20120731b-14.el7_9
`fontforge-debuginfo` Red Hat:rhel_els:7 From an advisory covering 3 CVEs	before 0:20120731b-14.el7_9	0:20120731b-14.el7_9
`fontforge-devel` Red Hat:rhel_els:7 From an advisory covering 3 CVEs	before 0:20120731b-14.el7_9	0:20120731b-14.el7_9
`fontforge` Rocky Linux:9 From an advisory covering 3 CVEs	before 0:20201107-7.el9_7	0:20201107-7.el9_7
`fontforge` Rocky Linux:10 From an advisory covering 3 CVEs	before 0:20230101-14.el10_1	0:20230101-14.el10_1
`fontforge` Rocky Linux:8 From an advisory covering 4 CVEs	before 0:20200314-7.el8_10	0:20200314-7.el8_10
`fontforge` SUSE:Linux Enterprise Server 16.0 From an advisory covering 4 CVEs	before 20251009-160000.1.1	20251009-160000.1.1
`fontforge` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 4 CVEs	before 20251009-160000.1.1	20251009-160000.1.1
`fontforge` SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 3 CVEs	before 20200314-150200.3.18.1	20200314-150200.3.18.1
`fontforge` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 3 CVEs	before 20200314-150200.3.18.1	20200314-150200.3.18.1
`fontforge` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 3 CVEs	before 20200314-150200.3.18.1	20200314-150200.3.18.1
`fontforge` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 3 CVEs	before 20200314-150200.3.18.1	20200314-150200.3.18.1
`fontforge` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 3 CVEs	before 20200314-150200.3.18.1	20200314-150200.3.18.1
`fontforge` SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 3 CVEs	before 20200314-150200.3.18.1	20200314-150200.3.18.1
`fontforge` SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 3 CVEs	before 20200314-150200.3.18.1	20200314-150200.3.18.1
`fontforge` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 3 CVEs	before 20200314-150200.3.18.1	20200314-150200.3.18.1
`fontforge` SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 3 CVEs	before 20200314-150200.3.18.1	20200314-150200.3.18.1
`fontforge` SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 3 CVEs	before 20200314-150200.3.18.1	20200314-150200.3.18.1
`fontforge` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 3 CVEs	before 20200314-150200.3.18.1	20200314-150200.3.18.1
`fontforge` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 20120731.b-520120731.b-5ubuntu120120731.b-7.120120731.b-7.1ubuntu0.120120731.b-7.1ubuntu0.1+esm1	None known
`fontforge` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1:20161005~dfsg-4+deb9u1ubuntu11:20170731~dfsg-11:20170731~dfsg-1ubuntu0.1~esm1	None known
`fontforge` Ubuntu:20.04:LTS	All versions, plus listed versions 1:20170731~dfsg-1build11:20170731~dfsg-21:20190801~dfsg-21:20190801~dfsg-2ubuntu11:20190801~dfsg-41:20190801~dfsg-4ubuntu0.1	None known
`fontforge` Ubuntu:22.04:LTS	All versions, plus listed versions 1:20201107~dfsg-41:20201107~dfsg-4build11:20201107~dfsg-4+deb11u1build0.22.04.1	None known
`fontforge` Ubuntu:24.04:LTS	All versions, plus listed versions 1:20230101~dfsg-1build11:20230101~dfsg-1build21:20230101~dfsg-1.11:20230101~dfsg-1.1build1	None known
`fontforge` Ubuntu:25.10	All versions, plus listed versions 1:20230101~dfsg-4build11:20230101~dfsg-4build21:20230101~dfsg-71:20230101~dfsg-8	None known
`fontforge` Ubuntu:26.10	All versions, plus listed versions 1:20230101~dfsg-8build11:20230101~dfsg-91:20251009+git20260808~dfsg-2	None known
`fontforge` Ubuntu:26.04:LTS	All versions, plus listed versions 1:20230101~dfsg-81:20230101~dfsg-8build1	None known
`fontforge` openSUSE:Tumbleweed From an advisory covering 3 CVEs	before 20251009-4.1	20251009-4.1
`fontforge` openSUSE:Leap 16.0 From an advisory covering 4 CVEs	before 20251009-160000.1.1	20251009-160000.1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-15279 is a high vulnerability (CVSS 7.8) in Fontforge, published December 31, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. No source names a fixed version.

References

Show 66 moreShow less

This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.