A critical remote code execution vulnerability exists in FontForge due to improper deserialization of untrusted SFD files, which may lead to full system compromise.

The vulnerability stems from CWE-502: Deserialization of Untrusted Data within the SFD file parsing logic. An unauthenticated attacker can trigger this flaw by enticing a user to open a specially crafted SFD file, resulting in arbitrary code execution in the context of the current process.

Successful exploitation of this vulnerability allows for remote code execution, granting attackers the ability to run arbitrary commands on the host system. Given the CVSS score of 7.8, this poses a high risk to organizational security, potentially leading to unauthorized data access, system disruption, or lateral movement within the network.

Immediate Action: Since a specific patch version is currently unconfirmed, users should exercise extreme caution when opening SFD files from untrusted sources and monitor official FontForge channels for the release of a security update.

Proactive Monitoring: Review system and application logs for abnormal process execution or unexpected file access patterns associated with the FontForge application.

Compensating Controls: Implement endpoint protection solutions to detect and block the execution of unauthorized or suspicious processes spawned by font processing software.

Public Exploit Available: Yes — a proof-of-concept exists on GitHub (https://github.com/ahmedreda38/CVE-2025-15276-poc).

Organizations should treat this vulnerability with high priority due to the potential for remote code execution. Administrators should restrict the use of FontForge to trusted files and ensure that security patches are applied as soon as the vendor makes them available to prevent potential exploitation.