{"id":"CVE-2025-50951","aliases":["DEBIAN-CVE-2025-50951","EUVD-2025-35699","GHSA-x45p-m5jm-48hc","UBUNTU-CVE-2025-50951"],"status":"published","title":"FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at ...","description":"FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0026,"percentile":0.17907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-401"],"published":"2025-10-23T00:00:00Z","modified":"2026-11-06T10:04:00Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-1","1:20230101~dfsg-1.1","1:20230101~dfsg-1.1~deb12u1","1:20230101~dfsg-2","1:20230101~dfsg-3","1:20230101~dfsg-4","1:20230101~dfsg-5","1:20230101~dfsg-6","1:20230101~dfsg-7","1:20230101~dfsg-8","1:20230101~dfsg-9","1:20251009+git20260808~dfsg-1","1:20251009+git20260808~dfsg-2","1:20251009+git20260808~dfsg-3"]},{"source":"osv","ecosystem":"Debian:13","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-4","1:20230101~dfsg-5","1:20230101~dfsg-6","1:20230101~dfsg-7","1:20230101~dfsg-8","1:20230101~dfsg-9","1:20251009+git20260808~dfsg-1","1:20251009+git20260808~dfsg-2","1:20251009+git20260808~dfsg-3"]},{"source":"osv","ecosystem":"Debian:14","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-4","1:20230101~dfsg-5","1:20230101~dfsg-6","1:20230101~dfsg-7","1:20230101~dfsg-8","1:20230101~dfsg-9","1:20251009+git20260808~dfsg-1","1:20251009+git20260808~dfsg-2","1:20251009+git20260808~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20120731.b-5","20120731.b-5ubuntu1","20120731.b-7.1","20120731.b-7.1ubuntu0.1","20120731.b-7.1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20161005~dfsg-4+deb9u1ubuntu1","1:20170731~dfsg-1","1:20170731~dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20170731~dfsg-1build1","1:20170731~dfsg-2","1:20190801~dfsg-2","1:20190801~dfsg-2ubuntu1","1:20190801~dfsg-4","1:20190801~dfsg-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20201107~dfsg-4","1:20201107~dfsg-4build1","1:20201107~dfsg-4+deb11u1build0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-1build1","1:20230101~dfsg-1build2","1:20230101~dfsg-1.1","1:20230101~dfsg-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-4build1","1:20230101~dfsg-4build2","1:20230101~dfsg-7","1:20230101~dfsg-8"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-8build1","1:20230101~dfsg-9","1:20251009+git20260808~dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-8","1:20230101~dfsg-8build1"]}],"products":[{"vendor":"fontforge","product":"fontforge"}],"references":[{"url":"https://github.com/fontforge/fontforge/pull/5495","tags":["Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50951"},{"url":"https://github.com/advisories/GHSA-x45p-m5jm-48hc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-50951","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-50951","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-50951","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-50951","description":"FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.","status":"published","published":"2025-10-23T00:00:00Z","modified":"2025-10-24T12:55:28.272Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:32:52.526476Z"}],"euvd":[{"id":"EUVD-2025-35699","description":"FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.","status":"published","published":"2025-10-23T00:00:00Z","modified":"2025-10-24T12:55:28Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:37.862275Z"}],"ghsa":[{"id":"GHSA-x45p-m5jm-48hc","title":"FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at ...","description":"FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.","status":"published","published":"2025-10-23T18:31:14Z","modified":"2025-10-24T15:32:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:04:12.620224Z"}],"nvd":[{"id":"CVE-2025-50951","description":"FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.","status":"published","published":"2025-10-23T16:16:33.703Z","modified":"2026-11-05T21:10:00.183Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-401"],"updated_at":"2026-11-05T23:57:15.690201Z"}],"osv":[{"id":"CVE-2025-50951","description":"FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.","status":"published","published":"2025-10-23T16:16:33.703Z","modified":"2026-04-10T05:29:17.546514Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-50951","description":"FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.","status":"published","published":"2025-10-23T16:16:33.703Z","modified":"2026-11-06T10:04:00.22104731Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"UBUNTU-CVE-2025-50951","description":"FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.","status":"published","published":"2025-10-23T16:16:00Z","modified":"2026-10-17T12:57:06.725996459Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"}]}}