FontForge SFD Heap Buffer Overflow RCE (CVE-2025-15272) Advisory

Vulnerability Key Information Vulnerability Name: FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability Release Date: December 29th, 2025 Vulnerability IDs: - ZDI-25-1192 - ZDI-CAN-28547 CVE ID: CVE-2025-15272 CVSS Score: 8.8 - CVSS Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Vendor: FontForge Affected Product: FontForge Vulnerability Details: - This vulnerability allows remote attackers to execute arbitrary code on affected FontForge installations. Exploitation requires user interaction, where the target must access a malicious page or open a malicious file. - The vulnerability exists in the SFD file parsing functionality, due to insufficient validation of the length of user-supplied data before copying it into a heap-based buffer. - Attackers can leverage this vulnerability to execute code in the context of the current user. Additional Details: - 2025-12-12 - ZDI submitted the report to the vendor via a third-party platform. - 2025-12-13 - ZDI contacted the vendor’s GitHub account. - 2025-12-14 - Vendor rejected the vulnerability report, stating they would only consider pull requests containing necessary fixes. - 2025-12-15 - ZDI notified the vendor that a 0-day advisory would be published on December 29th, 2025. Disclosure Timeline: - 2025-12-12 - Vulnerability reported to vendor - 2025-12-29 - Coordinated public advisory released - 2025-12-29 - Advisory updated Mitigation: Given the nature of the vulnerability, the only effective mitigation is to limit interaction with the product. Submitter: Anonymous

Goal Reached Thanks to every supporter — we hit 100%!

FontForge SFD Heap Buffer Overflow RCE (CVE-2025-15272) Advisory