CVE-2025-15270 — Improper Validation of Array Index in Fontforge

CWE-129 — Improper Validation of Array Index7 documents7 sources
Severity
8.8HIGHNVD
EPSS
0.2%
top 58.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FontforgeDebian Fontforge
Timeline
PublishedDec 31

Description

FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a wri…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5fontforge/fontforgeaca4f524c6cb14cdc7bc4cd493492a33f5154797
▶NVDfontforge/fontforge2025-11-17

🔴Vulnerability Details

2
GHSA
GHSA-hp8x-4h95-9799: FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability↗2025-12-31
▶
OSV
CVE-2025-15270: FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability↗2025-12-31
▶

📋Vendor Advisories

2
Red Hat
fontforge: FontForge: Remote Code Execution via malicious SFD file parsing↗2025-12-31
▶
Debian
CVE-2025-15270: fontforge - FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execut...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-15270 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

1
Bugzilla
CVE-2025-15270 fontforge: FontForge: Remote Code Execution via malicious SFD file parsing↗2025-12-31
▶
CVE-2025-15270 — Improper Validation of Array Index | cvebase