Integer Overflow Vulnerability in FontForge GUtils XBM File Parsing
CVE-2025-15278

7.8HIGH

Key Information:

Vendor

Fontforge

Status
Fontforge
Vendor
CVE Published:
31 December 2025

What is CVE-2025-15278?

The FontForge GUtils product contains a vulnerability within its processing of XBM files that could allow remote attackers to execute arbitrary code. This vulnerability arises from inadequate validation of user-input data during pixel parsing, leading to an integer overflow prior to buffer allocation. For exploitation, attackers need to lure users into visiting specially crafted web pages or opening harmful files, potentially executing code under the privileges of the user running FontForge. This issue highlights the importance of robust input validation mechanisms to safeguard against similar vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

FontForge 88de9b7dc76fbdef9069b7664ecc280f1c15ba2f

References

https://www.zerodayinitiative.com/advisories/ZDI-25-1185/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.