Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
FontForge can execute malicious code from crafted files
published 7 months ago
Summary
The FontForge font editor can be tricked by a specially made SFD file to run unwanted code on your system. This could let an attacker take control of the machine where FontForge is installed. Install the latest FontForge update from your Almalinux repository as soon as possible.
What to do
- Update almalinux fontforge to version 20230101-15.el10_1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | fontforge |
< 20230101-15.el10_1 Fix: upgrade to 20230101-15.el10_1
|
Original advisory text
Important: fontforge security update
FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.
Security Fix(es):
* fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:6631 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-15270 Third Party Advisory
- https://bugzilla.redhat.com/2426434 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-6631.html Vendor Advisory
Timeline
Published6 Apr 2026
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2026:6631 · OSV
Track software like this
Free during beta