---METADATA---
VENDOR: FontForge
PRODUCT: FontForge
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch, technical_details
SOURCES_JSON: [{"url":"https://github.com/fontforge/fontforge/pull/5495","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:45.290Z
---END_METADATA---

Description Summary:
A memory leak vulnerability exists in FontForge v20230101 within the utf7toutf8_copy function, potentially allowing for denial of service.

Executive Summary:
A memory leak vulnerability in FontForge could allow an unauthenticated attacker to cause a denial of service condition by processing a malicious file.

Vulnerability Details

CVE-ID: CVE-2025-50951

Affected Software: FontForge FontForge

Affected Versions: See vendor advisory

Vulnerability: This vulnerability is a memory leak located within the utf7toutf8_copy function in the sfd.c source file, which can be triggered by an unauthenticated attacker via a crafted file.

Business Impact

The exploitation of this memory leak could lead to significant system resource exhaustion, resulting in application crashes or a denial of service for users relying on FontForge for font manipulation. With a CVSS score of 7.5, this vulnerability is classified as High severity, reflecting its potential to disrupt critical workflows and impact availability of the affected software.

Remediation Plan

Immediate Action: Monitor the official FontForge GitHub repository for a patch or update release and apply it as soon as it becomes available.

Proactive Monitoring: Review system logs for unusual memory usage patterns or application crashes associated with FontForge execution.

Compensating Controls: Limit access to the application by processing untrusted font files only within isolated or sandboxed environments to mitigate the impact of potential crashes.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of October 23, 2025, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so the exploitation risk should be treated as credible. The vulnerability is inherent to the way the software handles specific string copies, making it susceptible to resource exhaustion if a malicious file is processed.

Analyst Recommendation

Given the High severity of this vulnerability and the existence of a proof-of-concept, administrators should prioritize tracking the upstream repository for security fixes. Users should exercise caution when handling untrusted font files until a patch is applied to prevent potential service disruption.

---METADATA---
VENDOR: FontForge
PRODUCT: FontForge
AFFECTED_VERSIONS: aca4f524c6cb14cdc7bc4cd493492a33f5154797
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1188/","name":"ZDI-25-1188","tags":["x_research-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.826Z
---END_METADATA---

Description Summary:
A use-after-free vulnerability in FontForge allows remote code execution when a user opens a specially crafted SFD file.

Executive Summary:
A critical use-after-free vulnerability in FontForge permits remote code execution, posing a significant risk to user workstations that process untrusted SFD files.

Vulnerability Details

CVE-ID: CVE-2025-15280

Affected Software: FontForge

Affected Versions: aca4f524c6cb14cdc7bc4cd493492a33f5154797

Vulnerability: This is a use-after-free flaw occurring during the parsing of SFD files, where the application fails to validate an object's existence before performing operations on it. The vulnerability is exploitable by an unauthenticated attacker, provided the user can be enticed to open a malicious file or visit a compromised web page.

Business Impact

The ability for an attacker to execute arbitrary code in the context of the current user presents a severe threat, including potential data theft, system compromise, or the installation of persistent malware. With a CVSS score of 8.8, this high-severity vulnerability necessitates prompt attention to prevent unauthorized access to local environments and sensitive information.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should avoid opening SFD files from untrusted sources until an official update is provided by the vendor. Monitor the Zero Day Initiative advisory for the release of fixed software versions.

Proactive Monitoring: Review system logs for unusual application crashes or process executions associated with FontForge. Organizations should restrict the execution of untrusted font files in sensitive environments.

Compensating Controls: Utilize endpoint protection software to detect and block malicious file execution attempts. Implementing strict application execution policies can further reduce the risk of exploitation.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Analyst Notes: As of January 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for user interaction limits its mass-exploitation potential, but the impact of code execution remains high.

Analyst Recommendation

Given the potential for remote code execution, administrators should treat this vulnerability with high urgency. Monitor the identified vendor references closely and apply the forthcoming security update immediately upon its release to secure affected installations.

---METADATA---
VENDOR: FontForge
PRODUCT: FontForge
AFFECTED_VERSIONS: 387146a241b36bcdf6ce229c5a3fe367ed3854a1
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1184/","name":"ZDI-25-1184","tags":["x_research-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.826Z
---END_METADATA---

Description Summary:
FontForge is vulnerable to a heap-based buffer overflow during BMP file parsing, potentially allowing remote code execution when a user opens a specially crafted file.

Executive Summary:
A heap-based buffer overflow in FontForge allows remote attackers to execute arbitrary code on the host system through the processing of malicious BMP files.

Vulnerability Details

CVE-ID: CVE-2025-15279

Affected Software: FontForge FontForge

Affected Versions: 387146a241b36bcdf6ce229c5a3fe367ed3854a1

Vulnerability: The vulnerability exists in the GUtils component during the parsing of BMP image pixels, where insufficient validation of user-supplied data leads to a heap-based buffer overflow. An unauthenticated attacker can trigger this flaw by enticing a user to open a malicious BMP file.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code in the context of the user running the FontForge application. With a CVSS score of 7.8, this represents a high-severity risk that could lead to full system compromise, data exfiltration, or the installation of persistent malicious software on the victim's workstation.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, users should exercise extreme caution when opening unknown BMP files and monitor vendor channels for the release of an official security update.

Proactive Monitoring: Security teams should monitor endpoint activity for unusual spawned processes originating from the FontForge application and inspect logs for application crashes that may indicate exploitation attempts.

Compensating Controls: Deploy endpoint protection solutions capable of detecting buffer overflow attempts and utilize application sandboxing or virtualization to isolate font processing tasks from the host operating system.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of January 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its memory corruption nature, which typically requires careful crafting of the input file to achieve reliable code execution.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability poses a significant risk to end-user workstations. Organizations should prioritize restricting the opening of untrusted BMP files within FontForge and maintain heightened vigilance for patches provided by the vendor. Immediate action is required to update the software as soon as a fix is released to prevent potential exploitation.

---METADATA---
VENDOR: FontForge
PRODUCT: FontForge
AFFECTED_VERSIONS: 88de9b7dc76fbdef9069b7664ecc280f1c15ba2f
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1185/","name":"ZDI-25-1185","tags":["x_research-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.826Z
---END_METADATA---

Description Summary:
FontForge contains an integer overflow vulnerability in the GUtils XBM file parser, which can be triggered by a malicious file to achieve remote code execution on the target system.

Executive Summary:
FontForge contains a critical integer overflow vulnerability that allows remote attackers to execute arbitrary code via a specially crafted XBM file.

Vulnerability Details

CVE-ID: CVE-2025-15278

Affected Software: FontForge FontForge

Affected Versions: 88de9b7dc76fbdef9069b7664ecc280f1c15ba2f

Vulnerability: The vulnerability exists in the GUtils component during the parsing of pixel data within XBM files. An attacker can trigger an integer overflow by providing a malicious file, which leads to improper buffer allocation and allows for code execution in the context of the current user.

Business Impact

Successful exploitation of this flaw allows an attacker to execute arbitrary code on the victim's machine, potentially leading to full system compromise. With a CVSS score of 7.8, this high severity vulnerability poses a significant risk to organizational integrity and data confidentiality, especially if FontForge is used in environments that process untrusted files from external sources.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should exercise extreme caution when opening XBM files from untrusted sources and monitor vendor channels for the release of a security update.

Proactive Monitoring: Security teams should monitor system logs for crashes or unexpected behavior occurring within the FontForge application during file processing operations.

Compensating Controls: Implement file integrity monitoring and restrict the execution of FontForge in environments that handle untrusted user-supplied content to limit potential impact.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available.

Analyst Notes: As of January 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw requires user interaction, such as opening a malicious file, the potential for remote code execution makes it a high priority for remediation once a fix is provided by the vendor.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability represents a significant security risk to any workstation or server running the affected version of FontForge. Administrators are advised to keep FontForge updated and subscribe to vendor security alerts to ensure the immediate application of the patch once it becomes available to prevent unauthorized code execution.

---METADATA---
VENDOR: FontForge
PRODUCT: FontForge
AFFECTED_VERSIONS: 88de9b7dc76fbdef9069b7664ecc280f1c15ba2f
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1186/","name":"ZDI-25-1186","tags":["x_research-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.830Z
---END_METADATA---

Description Summary:
A heap-based buffer overflow in FontForge allows remote attackers to execute arbitrary code via a specially crafted SGI file.

Executive Summary:
A critical heap-based buffer overflow vulnerability in FontForge permits remote code execution when a user opens a malicious SGI image file.

Vulnerability Details

CVE-ID: CVE-2025-15277

Affected Software: FontForge

Affected Versions: 88de9b7dc76fbdef9069b7664ecc280f1c15ba2f

Vulnerability: This vulnerability occurs during the parsing of scanlines within SGI files, where insufficient validation of user-supplied data length leads to a heap-based buffer overflow. An unauthenticated attacker can exploit this by tricking a user into opening a malicious file, resulting in code execution within the context of the current process.

Business Impact

Successful exploitation of this vulnerability allows for arbitrary code execution, which could lead to full system compromise, data exfiltration, or the installation of persistent backdoors. Given the CVSS score of 7.8, the vulnerability poses a high risk to organizational security, particularly for workstations or servers where FontForge is used to process untrusted image files.

Remediation Plan

Immediate Action: As a patch is currently not explicitly identified, users should restrict the opening of SGI files from untrusted sources and monitor for vendor updates to apply as soon as they become available.

Proactive Monitoring: Security teams should monitor system processes for anomalous activity or crashes associated with FontForge and review file access logs for interactions with suspicious image files.

Compensating Controls: Implement endpoint protection solutions that can detect and block the execution of malicious files and utilize application whitelisting to prevent unauthorized code execution.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of January 1, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for code execution, though it requires user interaction to trigger.

Analyst Recommendation

Given the severity of potential remote code execution, organizations should treat this vulnerability with high priority. Users are advised to exercise caution when handling SGI files from external sources and to maintain vigilance for official patch releases from the FontForge development team to mitigate this risk permanently.

---METADATA---
VENDOR: FontForge
PRODUCT: FontForge
AFFECTED_VERSIONS: 836f4e11e4cb890353393b36c0465ef445e0c4d4
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1187/","name":"ZDI-25-1187","tags":["x_research-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.830Z
---END_METADATA---

Description Summary:
A deserialization of untrusted data vulnerability in FontForge allows remote attackers to achieve remote code execution via malicious SFD file parsing.

Executive Summary:
A critical remote code execution vulnerability exists in FontForge due to improper deserialization of untrusted SFD files, which may lead to full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-15276

Affected Software: FontForge FontForge

Affected Versions: 836f4e11e4cb890353393b36c0465ef445e0c4d4

Vulnerability: The vulnerability stems from CWE-502: Deserialization of Untrusted Data within the SFD file parsing logic. An unauthenticated attacker can trigger this flaw by enticing a user to open a specially crafted SFD file, resulting in arbitrary code execution in the context of the current process.

Business Impact

Successful exploitation of this vulnerability allows for remote code execution, granting attackers the ability to run arbitrary commands on the host system. Given the CVSS score of 7.8, this poses a high risk to organizational security, potentially leading to unauthorized data access, system disruption, or lateral movement within the network.

Remediation Plan

Immediate Action: Since a specific patch version is currently unconfirmed, users should exercise extreme caution when opening SFD files from untrusted sources and monitor official FontForge channels for the release of a security update.

Proactive Monitoring: Review system and application logs for abnormal process execution or unexpected file access patterns associated with the FontForge application.

Compensating Controls: Implement endpoint protection solutions to detect and block the execution of unauthorized or suspicious processes spawned by font processing software.

Exploitation Status

Public Exploit Available: Yes — a proof-of-concept exists on GitHub (https://github.com/ahmedreda38/CVE-2025-15276-poc).

Analyst Notes: As of January 1, 2026, there is no public information indicating active exploitation in the wild, though a public proof-of-concept is available. The requirement for user interaction, specifically opening a malicious file, is the primary barrier to exploitation for this flaw.

Analyst Recommendation

Organizations should treat this vulnerability with high priority due to the potential for remote code execution. Administrators should restrict the use of FontForge to trusted files and ensure that security patches are applied as soon as the vendor makes them available to prevent potential exploitation.

---METADATA---
VENDOR: FontForge
PRODUCT: FontForge
AFFECTED_VERSIONS: aca4f524c6cb14cdc7bc4cd493492a33f5154797
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1189/","name":"ZDI-25-1189","tags":["x_research-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:01.138Z
---END_METADATA---

Description Summary:
A heap-based buffer overflow in FontForge SFD file parsing allows remote attackers to achieve arbitrary code execution via a maliciously crafted file.

Executive Summary:
A heap-based buffer overflow vulnerability in FontForge permits remote attackers to execute arbitrary code on the host system when a user opens a specially crafted SFD file.

Vulnerability Details

CVE-ID: CVE-2025-15275

Affected Software: FontForge FontForge

Affected Versions: aca4f524c6cb14cdc7bc4cd493492a33f5154797

Vulnerability: This vulnerability is a heap-based buffer overflow (CWE-122) occurring during the parsing of SFD files. It does not require prior authentication, though it does require user interaction, such as opening a malicious file or visiting a compromised webpage.

Business Impact

The ability for an unauthenticated remote attacker to execute arbitrary code poses a severe risk to organizational assets. Given the CVSS score of 8.8, this vulnerability could lead to a full system compromise, unauthorized data access, and potential lateral movement within the network. The reliance on user interaction does not diminish the impact, as social engineering or automated file processing can easily trigger the flaw.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should restrict the opening of untrusted SFD files and monitor vendor channels for the release of a security update.

Proactive Monitoring: Security teams should implement endpoint detection and response (EDR) solutions to monitor for suspicious process execution spawned by FontForge and analyze file access logs for anomalous activity.

Compensating Controls: Deploy endpoint application controls to restrict the execution of FontForge in environments where it is not required and utilize sandboxing technologies to isolate the application when processing external files.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of January 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is significant due to the nature of heap overflows, which often allow for reliable control flow hijacking when memory management is not properly validated.

Analyst Recommendation

Due to the high severity of this remote code execution vulnerability, FontForge users must prioritize the mitigation of this risk. While awaiting an official patch, administrators should enforce strict file handling policies and utilize security software to detect and block malicious SFD file processing attempts.

---METADATA---
VENDOR: FontForge
PRODUCT: FontForge
AFFECTED_VERSIONS: FontForge: aca4f524c6cb14cdc7bc4cd493492a33f5154797
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1190/","name":"ZDI-25-1190","tags":["x_research-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:01.138Z
---END_METADATA---

Description Summary:
A heap-based buffer overflow in FontForge's SFD file parsing allows remote code execution via a maliciously crafted file.

Executive Summary:
A heap-based buffer overflow vulnerability in FontForge permits remote code execution, posing a high risk to users who open untrusted SFD files.

Vulnerability Details

CVE-ID: CVE-2025-15274

Affected Software: FontForge

Affected Versions: FontForge: aca4f524c6cb14cdc7bc4cd493492a33f5154797

Vulnerability: The flaw exists within the parsing of SFD files and stems from insufficient validation of user-supplied data lengths before copying to a heap-based buffer. An unauthenticated remote attacker can trigger this overflow, leading to arbitrary code execution in the context of the current user, provided the user opens a malicious file.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the user running the FontForge application. With a CVSS score of 8.8, this represents a high-severity risk that could lead to a full system compromise, data theft, or the installation of persistent malware within the organization's environment.

Remediation Plan

Immediate Action: Since a direct patch is not yet identified, users should avoid opening untrusted or suspicious SFD files in FontForge until an official vendor update is released.

Proactive Monitoring: Security teams should monitor endpoint logs for unexpected child processes spawned by the FontForge application.

Compensating Controls: Ensure that users operate with the principle of least privilege, minimizing the damage an attacker can inflict if code execution is achieved.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for user interaction, specifically the opening of a malicious file, serves as the primary barrier to automated exploitation.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability should be treated with high priority. Organizations using FontForge should restrict the opening of external SFD files from untrusted sources and monitor for vendor security bulletins to apply the necessary patches as soon as they become available.

---METADATA---
VENDOR: FontForge
PRODUCT: FontForge
AFFECTED_VERSIONS: aca4f524c6cb14cdc7bc4cd493492a33f5154797
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1191/","name":"ZDI-25-1191","tags":["x_research-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:01.138Z
---END_METADATA---

Description Summary:
FontForge is vulnerable to a stack-based buffer overflow in its PFB file parsing logic, which allows a remote attacker to execute arbitrary code via a malicious file.

Executive Summary:
A critical stack-based buffer overflow vulnerability in FontForge could allow a remote attacker to execute arbitrary code on the host system via a maliciously crafted PFB file.

Vulnerability Details

CVE-ID: CVE-2025-15273

Affected Software: FontForge FontForge

Affected Versions: aca4f524c6cb14cdc7bc4cd493492a33f5154797

Vulnerability: The vulnerability exists due to improper validation of user-supplied data lengths when parsing PFB files, leading to a stack-based buffer overflow. An unauthenticated attacker can exploit this by enticing a user to open a malicious file or visit a site that triggers the parsing process.

Business Impact

The ability for an attacker to achieve remote code execution poses a severe risk to organizational security. Successful exploitation could lead to full system compromise, unauthorized data access, and potential lateral movement within the network. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that necessitates prioritized attention, particularly for systems that frequently process external font files.

Remediation Plan

Immediate Action: Since a specific patch version is currently unavailable, users should exercise extreme caution when opening untrusted PFB files and verify the source of all font data. Monitor vendor channels closely for the release of an official security update or mitigation patch.

Proactive Monitoring: Security teams should monitor system access logs and endpoint detection systems for unusual process execution patterns or crashes occurring during file parsing operations.

Compensating Controls: Deploy endpoint security solutions capable of detecting and blocking malicious file execution or anomalous memory access patterns. Restricting the use of FontForge to isolated or sandboxed environments can help minimize the risk of host compromise.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of January 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it leverages common file parsing operations to achieve code execution.

Analyst Recommendation

Given the high CVSS score and the potential for remote code execution, this vulnerability should be treated with high urgency. Organizations utilizing FontForge should prioritize restricting the processing of untrusted PFB files until an official vendor patch is released and applied to all affected installations.