CVE-2025-15277 — Heap-based Buffer Overflow in Fontforge

CWE-122 — Heap-based Buffer Overflow6 documents6 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 82.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FontforgeDebian Fontforge
Timeline
PublishedDec 31

Description

FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of scanlines within SGI files. The issue results from the lack of proper validation of the length of user-supplied d…

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5fontforge/fontforge88de9b7dc76fbdef9069b7664ecc280f1c15ba2f
▶NVDfontforge/fontforge20251009

🔴Vulnerability Details

2
OSV
CVE-2025-15277: FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability↗2025-12-31
▶
GHSA
GHSA-364x-6pf8-6vwj: FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability↗2025-12-31
▶

📋Vendor Advisories

2
Red Hat
fontforge: FontForge: Remote Code Execution via malicious SGI file parsing↗2025-12-31
▶
Debian
CVE-2025-15277: fontforge - FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Executi...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-15277 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-15277 — Heap-based Buffer Overflow | cvebase