A heap corruption vulnerability in GNOME Fonts Viewer 3.34.0 allows local attackers to cause an application crash through a specially crafted TrueType (TTF) font file.

The application is susceptible to a heap corruption flaw, classified as CWE-787: Out-of-bounds Write, occurring when processing TTF font files. An attacker can exploit this by providing a malicious file with an oversized pattern, which triggers an infinite malloc() loop and memory exhaustion, requiring no authentication.

Successful exploitation of this vulnerability results in a denial of service for the gnome-font-viewer process. While the impact is primarily availability-focused, the ability to crash local processes can disrupt user workflows and system stability. Given the CVSS score of 7.5, this is considered a high-severity issue because it facilitates an effective local attack vector capable of destabilizing the user environment.

Immediate Action: Users and administrators should update the GNOME Fonts Viewer to the latest available version provided by their distribution maintainers to incorporate the necessary memory handling fixes.

Proactive Monitoring: Security teams should monitor system logs for repeated process crashes related to gnome-font-viewer or unusual memory consumption spikes when users interact with untrusted font files.

Compensating Controls: Implement strict file access controls or endpoint security policies that prevent standard users from opening untrusted or externally sourced font files in the viewer application.

Public Exploit Available: Yes — a functional proof-of-concept exploit is available via ExploitDB (EDB-ID: 48803).

This vulnerability presents a clear risk to system stability for users of the affected GNOME Fonts Viewer version. Organizations should prioritize updating the software across all Linux workstations to the latest patched version. If an update is not immediately feasible, restrict the use of the viewer to trusted font files only to mitigate the risk of local denial-of-service attacks.