{ "cveId": "CVE-2025-15270", "url": "https://patchblox.com/security/cve/CVE-2025-15270", "summary": "CVE-2025-15270 is fixed in 5 products on 1 platform, first by RHSA-2026:8875, released December 31, 2025. It is not reported as exploited. Patch Radar priority: High.", "title": "fontforge: FontForge is a font editor for outline and bitmap fonts", "description": "FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. \n\nSecurity Fix(es):\n\n* fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279)\n\n* fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269)\n\n* fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275)\n\n* fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "published": "2025-12-31T06:58:49Z", "severity": "Important", "cvss": 8.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "epss": 0.0061, "epssPercentile": 0.49487, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "fontforge", "release": "Fedora 43", "fixedVersion": "20230101-20.fc43", "fix": "FEDORA-2026-4F7402837E", "url": "https://patchblox.com/security/fix/linux/fedora-2026-4f7402837e", "released": "2026-03-18T06:53:52Z" }, { "platform": "linux", "product": "fontforge", "release": "RHEL 10", "fixedVersion": "20230101-15.el10_0", "fix": "RHSA-2026:8875", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-8875", "released": "2025-12-31T06:58:49Z" }, { "platform": "linux", "product": "fontforge", "release": "RHEL 8", "fixedVersion": "0:20200314-7.el8_10", "fix": "RHSA-2026:7677", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-7677", "released": "2026-04-15T19:03:41Z" }, { "platform": "linux", "product": "fontforge", "release": "RHEL 9", "fixedVersion": "0:20201107-8.el9_7", "fix": "RHSA-2026:6628", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-6628", "released": "2026-04-15T19:05:11Z" }, { "platform": "linux", "product": "fontforge", "release": "almalinux 10", "fixedVersion": "20230101-15.el10_1", "fix": "ALSA-2026:6631", "url": "https://patchblox.com/security/fix/linux/alsa-2026-6631", "released": "2026-04-06T00:00:00Z" }, { "platform": "linux", "product": "fontforge", "release": "almalinux 8", "fixedVersion": "20200314-7.el8_10", "fix": "ALSA-2026:7677", "url": "https://patchblox.com/security/fix/linux/alsa-2026-7677", "released": "2026-04-13T00:00:00Z" }, { "platform": "linux", "product": "fontforge", "release": "almalinux 9", "fixedVersion": "20201107-8.el9_7", "fix": "ALSA-2026:6628", "url": "https://patchblox.com/security/fix/linux/alsa-2026-6628", "released": "2026-04-06T00:00:00Z" }, { "platform": "linux", "product": "fontforge", "release": "amzn 2023", "fixedVersion": "20201107-3.amzn2023.0.6", "fix": "ALAS2023-2026-1431", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1431", "released": "2026-02-16T09:00:00Z" }, { "platform": "linux", "product": "fontforge", "release": "ol 10", "fixedVersion": "0:20230101-15.el10_1", "fix": "ELSA-2026-6631", "url": "https://patchblox.com/security/fix/linux/elsa-2026-6631", "released": "2026-04-07T00:00:00Z" }, { "platform": "linux", "product": "fontforge", "release": "ol 8", "fixedVersion": "0:20200314-7.el8_10", "fix": "ELSA-2026-7677", "url": "https://patchblox.com/security/fix/linux/elsa-2026-7677", "released": "2026-04-14T00:00:00Z" }, { "platform": "linux", "product": "fontforge", "release": "ol 9", "fixedVersion": "0:20201107-8.el9_7", "fix": "ELSA-2026-6628", "url": "https://patchblox.com/security/fix/linux/elsa-2026-6628", "released": "2026-04-06T00:00:00Z" }, { "platform": "linux", "product": "fontforge", "release": "opensuse-leap 16.0", "fixedVersion": "20251009-160000.2.1", "fix": "OPENSUSE-SU-2026:20608-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20608-1", "released": "2026-04-22T10:52:20Z" }, { "platform": "linux", "product": "fontforge", "release": "rocky 10", "fixedVersion": "0:20230101-15.el10_1", "fix": "RLSA-2026:6631", "url": "https://patchblox.com/security/fix/linux/rlsa-2026-6631", "released": "2026-04-09T12:07:30Z" }, { "platform": "linux", "product": "fontforge", "release": "rocky 8", "fixedVersion": "0:20200314-7.el8_10", "fix": "RLSA-2026:7677", "url": "https://patchblox.com/security/fix/linux/rlsa-2026-7677", "released": "2026-04-14T12:01:52Z" }, { "platform": "linux", "product": "fontforge", "release": "rocky 9", "fixedVersion": "0:20201107-8.el9_7", "fix": "RLSA-2026:6628", "url": "https://patchblox.com/security/fix/linux/rlsa-2026-6628", "released": "2026-04-08T06:02:16Z" }, { "platform": "linux", "product": "fontforge-debuginfo", "release": "Fedora 43", "fixedVersion": "20230101-20.fc43", "fix": "FEDORA-2026-4F7402837E", "url": "https://patchblox.com/security/fix/linux/fedora-2026-4f7402837e", "released": "2026-03-18T06:53:52Z" }, { "platform": "linux", "product": "fontforge-debuginfo", "release": "amzn 2023", "fixedVersion": "20201107-3.amzn2023.0.6", "fix": "ALAS2023-2026-1431", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1431", "released": "2026-02-16T09:00:00Z" }, { "platform": "linux", "product": "fontforge-debugsource", "release": "Fedora 43", "fixedVersion": "20230101-20.fc43", "fix": "FEDORA-2026-4F7402837E", "url": "https://patchblox.com/security/fix/linux/fedora-2026-4f7402837e", "released": "2026-03-18T06:53:52Z" }, { "platform": "linux", "product": "fontforge-debugsource", "release": "amzn 2023", "fixedVersion": "20201107-3.amzn2023.0.6", "fix": "ALAS2023-2026-1431", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1431", "released": "2026-02-16T09:00:00Z" }, { "platform": "linux", "product": "fontforge-devel", "release": "Fedora 43", "fixedVersion": "20230101-20.fc43", "fix": "FEDORA-2026-4F7402837E", "url": "https://patchblox.com/security/fix/linux/fedora-2026-4f7402837e", "released": "2026-03-18T06:53:52Z" }, { "platform": "linux", "product": "fontforge-devel", "release": "amzn 2023", "fixedVersion": "20201107-3.amzn2023.0.6", "fix": "ALAS2023-2026-1431", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1431", "released": "2026-02-16T09:00:00Z" }, { "platform": "linux", "product": "fontforge-doc", "release": "Fedora 43", "fixedVersion": "20230101-20.fc43", "fix": "FEDORA-2026-4F7402837E", "url": "https://patchblox.com/security/fix/linux/fedora-2026-4f7402837e", "released": "2026-03-18T06:53:52Z" }, { "platform": "linux", "product": "fontforge-doc", "release": "amzn 2023", "fixedVersion": "20201107-3.amzn2023.0.6", "fix": "ALAS2023-2026-1431", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1431", "released": "2026-02-16T09:00:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T07:25:28Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }