Remote Code Execution Vulnerability in FontForge SFD File Parsing by FontForge
CVE-2025-15276
7.8HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-15276?
A vulnerability in FontForge allows remote attackers to execute arbitrary code by exploiting a flaw in the parsing of SFD files. This vulnerability arises due to inadequate validation of data supplied by users, which leads to the deserialization of untrusted data. Attackers must induce user interaction by enticing the target to visit a malicious webpage or open a harmful file. Successful exploitation enables the attacker to execute code within the context of the affected process.
Affected Version(s)
FontForge 836f4e11e4cb890353393b36c0465ef445e0c4d4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.