CVE-2025-15271
Improper Array Index Validation in FontForge SFD Leads to RCE
Publication date: 2025-12-31
Last updated on: 2025-12-31
Assigner: Zero Day Initiative
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fontforge | fontforge | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-129 | The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15271 is a remote code execution vulnerability in FontForge that occurs due to improper validation of array indices when parsing SFD files. This flaw allows an attacker to write past the end of an allocated array by supplying malicious data. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious webpage, and enables the attacker to execute arbitrary code with the privileges of the current user. [1]
How can this vulnerability impact me? :
This vulnerability can allow remote attackers to execute arbitrary code on your system with the privileges of the current user. This can lead to unauthorized access, data theft, system compromise, or disruption of services. Since the attack requires user interaction, the risk arises when a user opens a malicious file or visits a malicious webpage. The high CVSS score of 8.8 indicates a severe impact on confidentiality, integrity, and availability. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid opening untrusted SFD files or visiting untrusted webpages that could contain malicious FontForge files. Ensure that your FontForge installation is updated with any patches provided by the vendor addressing this issue. Additionally, restrict user privileges to limit the impact of potential exploitation. [1]