CVE-2020-25690

2021-02-2303:40:04

CWE-119

redhat

www.cve.org

fontforge

out-of-bounds write

sfd files

memory manipulation

arbitrary code

confidentiality

integrity

system availability

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

60.4%

JSON

An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CNA Affected

[
  {
    "product": "fontforge",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "fontforge before 20200314"
      }
    ]
  }
]