Remote Code Execution Vulnerability in FontForge SFD File Parsing by FontForge

CVE-2025-15271

What is CVE-2025-15271?

A vulnerability exists in FontForge related to the parsing of SFD files, where the application fails to properly validate user-supplied array indices. This flaw permits remote attackers to execute arbitrary code on affected installations by enticing users to visit a malicious page or open a malicious SFD file. The lack of validation may allow an attacker to write beyond the allocated boundaries of memory, leading to potential code execution in the context of the victim's user account.

References