PT-2025-53827 · Fontforge+1 · Fontforge+1

Published 2025-01-01 · Updated 2025-12-31 · CVE-2025-15280

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FontForge (affected versions not specified)

Description This issue is a use-after-free remote code execution flaw in FontForge, specifically within the parsing of SFD files. Successful exploitation allows remote attackers to execute arbitrary code on affected systems. User interaction is required, as an attacker must trick a user into visiting a malicious page or opening a malicious file. The flaw stems from a lack of validation to confirm the existence of an object before operations are performed on it, enabling an attacker to execute code with the privileges of the current user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2025-15280

ZDI-25-1188

Affected Products

Debian

Fontforge

References · 12

• https://osv.dev/vulnerability/DEBIAN-CVE-2025-15280 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-1188 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-15280 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-15280 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-15280 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15280 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-15280 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-15280 · Vendor Advisory
• https://twitter.com/CVEnew/status/2006332197826093212 · Twitter Post
• https://t.me/CVEtracker/41048 · Telegram Post
• https://twitter.com/TheHackerWire/status/2006267481607004273 · Twitter Post
• https://twitter.com/CveFindCom/status/2006268853798457830 · Twitter Post