{"id":"CVE-2025-15270","aliases":["ALSA-2026:6628","ALSA-2026:6631","ALSA-2026:7677","DEBIAN-CVE-2025-15270","EUVD-2025-205897","GHSA-hp8x-4h95-9799","MGASA-2026-0034","RHSA-2026:6628","RHSA-2026:6631","RHSA-2026:6635","RHSA-2026:7001","RHSA-2026:7677","RHSA-2026:8875","RLSA-2026:6628","RLSA-2026:6631","RLSA-2026:7677","SUSE-SU-2026:1636-1","SUSE-SU-2026:21375-1","UBUNTU-CVE-2025-15270","openSUSE-SU-2026:10513-1","openSUSE-SU-2026:20608-1"],"status":"published","title":"FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability","description":"FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0061,"percentile":0.49726,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-129"],"published":"2025-12-31T06:58:49Z","modified":"2026-10-29T11:58:15Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"fontforge","fixed_in":["20201107-8.el9_7"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"fontforge","fixed_in":["20230101-15.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fontforge","fixed_in":["0:20201107-8.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fontforge-debuginfo","fixed_in":["0:20201107-8.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fontforge-debugsource","fixed_in":["0:20201107-8.el9_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"fontforge","fixed_in":["0:20230101-15.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"fontforge-debuginfo","fixed_in":["0:20230101-15.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"fontforge-debugsource","fixed_in":["0:20230101-15.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"fontforge","fixed_in":["0:20201107-8.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"fontforge-debuginfo","fixed_in":["0:20201107-8.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"fontforge-debugsource","fixed_in":["0:20201107-8.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"fontforge","fixed_in":["0:20201107-7.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"fontforge-debuginfo","fixed_in":["0:20201107-7.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"fontforge-debugsource","fixed_in":["0:20201107-7.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"fontforge","fixed_in":["0:20230101-15.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"fontforge-debuginfo","fixed_in":["0:20230101-15.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"fontforge-debugsource","fixed_in":["0:20230101-15.el10_0"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"fontforge","fixed_in":["0:20201107-8.el9_7"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"fontforge","fixed_in":["0:20230101-15.el10_1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"fontforge","fixed_in":["20251009-6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"fontforge","fixed_in":["20251009-160000.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20201107-8.el9_7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230101-15.el10_1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-1","1:20230101~dfsg-1.1","1:20230101~dfsg-1.1~deb12u1","1:20230101~dfsg-2","1:20230101~dfsg-3","1:20230101~dfsg-4","1:20230101~dfsg-5","1:20230101~dfsg-6","1:20230101~dfsg-7","1:20230101~dfsg-8","1:20230101~dfsg-9","1:20251009+git20260808~dfsg-1","1:20251009+git20260808~dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-4","1:20230101~dfsg-5","1:20230101~dfsg-6","1:20230101~dfsg-7","1:20230101~dfsg-8","1:20230101~dfsg-9","1:20251009+git20260808~dfsg-1","1:20251009+git20260808~dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-4","1:20230101~dfsg-5","1:20230101~dfsg-6","1:20230101~dfsg-7","1:20230101~dfsg-8","1:20230101~dfsg-9","1:20251009+git20260808~dfsg-1","1:20251009+git20260808~dfsg-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220308-2.2.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-8.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fontforge-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-8.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fontforge-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-8.el9_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230101-15.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"fontforge-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230101-15.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"fontforge-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230101-15.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-8.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"fontforge-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-8.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"fontforge-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-8.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-7.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"fontforge-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-7.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"fontforge-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-7.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200314-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fontforge-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200314-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fontforge-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200314-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230101-15.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"fontforge-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230101-15.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"fontforge-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230101-15.el10_0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-8.el9_7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230101-15.el10_1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200314-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20120731.b-5","20120731.b-5ubuntu1","20120731.b-7.1","20120731.b-7.1ubuntu0.1","20120731.b-7.1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20161005~dfsg-4+deb9u1ubuntu1","1:20170731~dfsg-1","1:20170731~dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20170731~dfsg-1build1","1:20170731~dfsg-2","1:20190801~dfsg-2","1:20190801~dfsg-2ubuntu1","1:20190801~dfsg-4","1:20190801~dfsg-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20201107~dfsg-4","1:20201107~dfsg-4build1","1:20201107~dfsg-4+deb11u1build0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-1build1","1:20230101~dfsg-1build2","1:20230101~dfsg-1.1","1:20230101~dfsg-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-4build1","1:20230101~dfsg-4build2","1:20230101~dfsg-7","1:20230101~dfsg-8"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-8build1","1:20230101~dfsg-9","1:20251009+git20260808~dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-8","1:20230101~dfsg-8build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251009-6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251009-160000.2.1"}]}]}],"products":[{"vendor":"fontforge","product":"fontforge"}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1194/","tags":["x_research-advisory","Third Party Advisory","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15270","tags":["advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1194"},{"url":"https://github.com/advisories/GHSA-hp8x-4h95-9799","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6628","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15270","tags":["report"]},{"url":"https://bugzilla.redhat.com/2426434","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-6628.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6631","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-6631.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7677","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15269","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15275","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15279","tags":["report"]},{"url":"https://bugzilla.redhat.com/2426421","tags":["report"]},{"url":"https://bugzilla.redhat.com/2426423","tags":["report"]},{"url":"https://bugzilla.redhat.com/2426429","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-7677.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-15270","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0034.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35091","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NFM3OPUTYR55GA65K3XOPK3FXAH7EWEJ/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426434","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6628.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15270","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6631.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6635","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6635.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7001","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7001.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426429","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7677.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15269","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15269","tags":["advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1195/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15275","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15275","tags":["advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1189/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15279","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15279","tags":["advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1184/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8875","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8875.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:6628","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:6631","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7677","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261636-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256031","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15270","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621375-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-15270","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-15270","title":"FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability","description":"FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.","status":"published","published":"2025-12-31T06:58:49.796Z","modified":"2025-12-31T16:58:50.233Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:32:37.351404Z"}],"euvd":[{"id":"EUVD-2025-205897","description":"FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.","status":"published","published":"2025-12-31T06:58:49Z","modified":"2025-12-31T16:58:50Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:59.455836Z"}],"ghsa":[{"id":"GHSA-hp8x-4h95-9799","title":"FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability...","description":"FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.","status":"published","published":"2025-12-31T09:30:18Z","modified":"2025-12-31T09:31:34Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T15:05:24.798125Z"}],"nvd":[{"id":"CVE-2025-15270","description":"FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.","status":"published","published":"2025-12-31T07:15:50.897Z","modified":"2026-06-17T08:37:30.127Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:11:54.323368Z"}],"osv":[{"id":"CVE-2025-15270","description":"FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.","status":"published","published":"2025-12-31T07:15:50.897Z","modified":"2026-04-29T18:29:23.152401006Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DEBIAN-CVE-2025-15270","description":"FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.","status":"published","published":"2025-12-31T07:15:50.897Z","modified":"2026-09-01T20:05:41.359036562Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"RHSA-2026:6628","title":"Red Hat Security Advisory: fontforge security update","status":"published","published":"2026-04-06T10:06:39Z","modified":"2026-07-09T10:14:43Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:6631","title":"Red Hat Security Advisory: fontforge security update","status":"published","published":"2026-04-07T10:09:08Z","modified":"2026-07-09T10:14:43Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:6635","title":"Red Hat Security Advisory: fontforge security update","status":"published","published":"2026-04-06T10:06:41Z","modified":"2026-07-09T10:14:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:7001","title":"Red Hat Security Advisory: fontforge security update","status":"published","published":"2026-04-08T10:09:09Z","modified":"2026-07-09T10:14:53Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:7677","title":"Red Hat Security Advisory: fontforge security update","status":"published","published":"2026-04-13T10:07:24Z","modified":"2026-07-09T10:15:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:8875","title":"Red Hat Security Advisory: fontforge security update","status":"published","published":"2026-04-20T10:12:32Z","modified":"2026-07-09T10:15:38Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:6628","title":"Important: fontforge security update","description":"FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. \n\nSecurity Fix(es):\n\n* fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-08T06:02:16.043758Z","modified":"2026-04-08T06:30:20.675197Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:6631","title":"Important: fontforge security update","description":"FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. \n\nSecurity Fix(es):\n\n* fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-09T12:07:30.40568Z","modified":"2026-04-09T12:30:35.242058Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7677","title":"Important: fontforge security update","description":"FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. \n\nSecurity Fix(es):\n\n* fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279)\n\n* fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269)\n\n* fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275)\n\n* fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-14T12:01:52.8526Z","modified":"2026-04-14T12:30:10.663388Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2025-15270","description":"FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.","status":"published","published":"2025-12-31T07:15:00Z","modified":"2026-10-17T12:56:48.333807749Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"ALSA-2026:6628","title":"Important: fontforge security update","description":"FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.   \n\nSecurity Fix(es):  \n\n  * fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-06T00:00:00Z","modified":"2026-10-29T11:32:37.331805693Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:6631","title":"Important: fontforge security update","description":"FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.   \n\nSecurity Fix(es):  \n\n  * fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-06T00:00:00Z","modified":"2026-10-29T11:58:15.032444Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7677","title":"Important: fontforge security update","description":"FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.   \n\nSecurity Fix(es):  \n\n  * fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279)\n  * fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269)\n  * fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275)\n  * fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:02:29.760399153Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"MGASA-2026-0034","title":"Updated fontforge packages fix security vulnerabilities","description":"FontForge SFD File Parsing Use-After-Free Remote Code Execution\nVulnerability. (CVE-2025-15269)\nFontForge SFD File Parsing Improper Validation of Array Index Remote\nCode Execution Vulnerability. (CVE-2025-15270)\nFontForge SFD File Parsing Heap-based Buffer Overflow Remote Code\nExecution Vulnerability. (CVE-2025-15275)\nFontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code\nExecution Vulnerability. (CVE-2025-15279)\n","status":"published","published":"2026-02-09T19:56:34Z","modified":"2026-04-16T04:42:20.682765975Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10513-1","title":"fontforge-20251009-6.1 on GA media","description":"These are all security issues fixed in the fontforge-20251009-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-09T00:00:00Z","modified":"2026-04-10T09:46:14.56308Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20608-1","title":"Security update for fontforge","description":"This update for fontforge fixes the following issues:\n\n- CVE-2025-15270: lack of proper validation of user-supplied data when parsing SFD files can lead to OOB writes and\n  arbitrary code execution (bsc#1256031).\n","status":"published","published":"2026-04-22T10:52:20Z","modified":"2026-04-24T08:16:31.828845Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1636-1","title":"Security update for fontforge","description":"This update for fontforge fixes the following issue:\n\n- CVE-2025-15270: Remote code execution via malicious SFD file parsing (bsc#1256031).\n","status":"published","published":"2026-04-27T16:55:27Z","modified":"2026-04-29T08:01:21.889835Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21375-1","title":"Security update for fontforge","description":"This update for fontforge fixes the following issues:\n\n- CVE-2025-15270: lack of proper validation of user-supplied data when parsing SFD files can lead to OOB writes and\n  arbitrary code execution (bsc#1256031).\n","status":"published","published":"2026-04-22T11:09:31Z","modified":"2026-04-29T18:23:57.609598Z","updated_at":"2026-11-02T15:54:02.312556Z"}]}}