CVE-2025-15271 — Improper Validation of Array Index in Fontforge

CWE-129 — Improper Validation of Array Index6 documents6 sources
Severity
8.8HIGHNVD
EPSS
0.2%
top 58.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FontforgeDebian Fontforge
Timeline
PublishedDec 31

Description

FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a wri…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5fontforge/fontforgeaca4f524c6cb14cdc7bc4cd493492a33f5154797
▶NVDfontforge/fontforge2025-11-17

🔴Vulnerability Details

2
GHSA
GHSA-gwg7-r3vr-jqwf: FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability↗2025-12-31
▶
OSV
CVE-2025-15271: FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability↗2025-12-31
▶

📋Vendor Advisories

2
Red Hat
fontforge: FontForge: Remote Code Execution via SFD file parsing vulnerability↗2025-12-31
▶
Debian
CVE-2025-15271: fontforge - FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execut...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-15271 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-15271 — Improper Validation of Array Index | cvebase