CVE-2025-50951
BaseFortify
Publication date: 2025-10-23
Last updated on: 2025-10-27
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fontforge | fontforge | 2023-01-01 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-50951 is a memory leak vulnerability in the FontForge software, specifically in the function utf7toutf8_copy located in the source file sfd.c. The vulnerability arises from improper memory management where allocated memory is not properly freed, causing a leak. This issue was detected using LeakSanitizer and affects FontForge versions up to and including 20230101. The leak involves a direct loss of 140 bytes across 4 objects allocated by malloc. The problem was fixed by correcting the memory handling in the utf7toutf8_copy function to ensure all allocated memory is properly released. [1]
How can this vulnerability impact me? :
This memory leak vulnerability can lead to resource exhaustion, potentially causing a Denial of Service (DoS) condition. If exploited, the software could consume increasing amounts of memory, eventually impacting system stability or availability. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by compiling FontForge with LeakSanitizer enabled using the compiler flag `-fsanitize=leak` and then running a test command to open a specially crafted proof-of-concept file. LeakSanitizer will report memory leaks, such as the direct leak of 140 bytes in the `utf7toutf8_copy` function. Example command to compile: `gcc -fsanitize=leak ...` and then run FontForge with the test file to observe leaks. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update FontForge to a version that includes the fix merged after version 20230101, where the memory leak in `utf7toutf8_copy` was corrected by proper memory management. Until an updated version is applied, avoid processing files that could trigger the vulnerability to prevent potential Denial of Service due to resource exhaustion. [1]