CVE-2025-15272

DOCUMENTATION: A flaw was found in FontForge. This heap-based buffer overflow vulnerability allows a remote attacker to execute arbitrary code on the system. The flaw occurs during the parsing of SFD (Spline Font Database) files due to insufficient validation of user-supplied data length. Successful exploitation requires user interaction, such as opening a specially crafted malicious SFD file. 

            STATEMENT: This vulnerability is rated Important for Red Hat products. A heap-based buffer overflow in FontForge, occurring during SFD file parsing, allows a remote attacker to execute arbitrary code. Exploitation requires user interaction, specifically opening a specially crafted malicious SFD file. This affects FontForge in Red Hat Enterprise Linux and Fedora.

            MITIGATION: Users should avoid opening SFD (Spline Font Database) files from untrusted sources. If FontForge is not essential for system operation, consider removing the fontforge package. To remove the package on Red Hat Enterprise Linux: sudo dnf remove fontforge. Removing this package may impact functionality for applications that rely on FontForge.