Astra Linux – Vulnerability in FontForge

Splinefont in FontForge, with a version number of 20230101, allows for command injection through crafted archives or compressed files...

CVE-2024-25082_CVE-2024-25081

⚠️ FontForge RCE — CVE-2024-25081 & CVE-2024-25082 - PoC 📖 Overview Proof-of-concept exploit for two command injection vulnerabilities in FontForge ≤ 20230101 Splinefont component...

CVE-2025-15276-poc

CVE-2025-15276: FontForge SFD PickledData Insecure Deserialization RCE Disclaimer This Proof of Concept PoC is for educational purposes and security auditing only. The author is not responsible for any misuse of this information. Unauthorized access to computer systems is illegal. Always obtain...

CVE-2024-25081_2025-47273

CVE-2024-25081 和 CVE-2025-47273 概念验证 FontForge ≤ 20230101 版本 和 Setuptools 库 概念验证用于提升运行使用 Font Forge 的任务的用户的权限。第二个 CVE 能够将权限提升至 root，前提是您对敏感目录拥有写入权限。 更多信息： CVE ID| 漏洞| 影响 ---|---|--- CVE-2024-25081| 在将文件名传递给 shell 之前未进行清理| 命令注入（以所有者用户身份） CVE-2025-47273| 在解码 URL 之前进行初步清理 - URL编码| 路径遍历并写入文件...

CVE-2024-25082

⚠️ CVE-2024-25082 - FontForge ZIP リモートコード実行 PoC CVE-2024-25082 の Proof-of-Concept エクスプロイト。FontForge に影響を与える脆弱性で、細工された ZIP アーカイブを介してリモートコード実行 RCE を可能にします。 このリポジトリは、セキュリティ研究および教育目的 のために、管理されたラボ環境でこの脆弱性をどのように悪用できるかを示しています。 脆弱性の概要 CVE ID: CVE-2024-25082\ 影響を受けるソフトウェア: FontForge\ 脆弱性の種類: リモートコード実行...

Astra Linux – Vulnerability in FontForge

Splinefont in FontForge, with a version number of 20230101, allows for command injection via crafted filenames...

Astra Linux – Vulnerability in FontForge

FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines function in splinesave.c...

Astra Linux – Vulnerability in FontForge

FontForge 20190801 has a use-after-free in SFDGetFontMetaData in sfd.c...

SUSE-SU-2026:2739-1 Security update for fontforge

This update for fontforge fixes the following issues - CVE-2025-15269: Remote Code Execution via Use-After-Free in SFD file parsing bsc1256032. - CVE-2025-15275: Arbitrary code execution via SFD file parsing buffer overflow bsc1256025. - CVE-2025-15279: Remote Code Execution via heap-based buffer...

TencentOS Server 3: fontforge (TSSA-2026:0357)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0357 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

SUSE SLED15 / SLES15 Security Update : fontforge (SUSE-SU-2026:1636-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1636-1 advisory. This update for fontforge fixes the following issue: - CVE-2025-15270: Remote Code Execution via malicious SFD file...

Security update for fontforge

This update for fontforge fixes the following issue: CVE-2025-15270: Remote code execution via malicious SFD file parsing bsc1256031. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run t...

SUSE-SU-2026:1636-1 Security update for fontforge

This update for fontforge fixes the following issue: - CVE-2025-15270: Remote code execution via malicious SFD file parsing bsc1256031...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: fontforge (UTSA-2026-014311)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014311 advisory. FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: fontforge (UTSA-2026-014308)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014308 advisory. FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: fontforge (UTSA-2026-014309)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014309 advisory. FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod...

openSUSE 16 Security Update : fontforge (openSUSE-SU-2026:20608-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20608-1 advisory. - CVE-2025-15270: lack of proper validation of user-supplied data when parsing SFD files can lead to OOB writes and arbitrary code execution bsc1256031...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: fontforge (UTSA-2026-014310)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014310 advisory. FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

SUSE-SU-2026:21375-1 Security update for fontforge

This update for fontforge fixes the following issues: - CVE-2025-15270: lack of proper validation of user-supplied data when parsing SFD files can lead to OOB writes and arbitrary code execution bsc1256031...

OPENSUSE-SU-2026:20608-1 Security update for fontforge

This update for fontforge fixes the following issues: - CVE-2025-15270: lack of proper validation of user-supplied data when parsing SFD files can lead to OOB writes and arbitrary code execution bsc1256031...