https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 14:02:53 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:6628 <p><strong>Affected:</strong> AlmaLinux:9: fontforge</p> <p>FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.</p> <p>Security Fix(es):</p> <p>* fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: fontforge</p> <p>FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.</p> <p>Security Fix(es):</p> <p>* fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:6628 https://cve.radiocsirt.org/vuln/euvd-2026-264716 EUVD-2026-264716 https://cve.radiocsirt.org/vuln/euvd-2026-264716 https://cve.radiocsirt.org/vuln/fkie_cve-2025-15270 <p>FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.</p> <p>FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-15270 https://cve.radiocsirt.org/vuln/ghsa-hp8x-4h95-9799 <p>FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.</p> <p>FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.</p> https://cve.radiocsirt.org/vuln/ghsa-hp8x-4h95-9799 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10513-1 <p>fontforge-20251009-6.1 on GA media</p> <p>fontforge-20251009-6.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10513-1 https://cve.radiocsirt.org/vuln/rhsa-2026:7001 <p>fontforge: FontForge: Remote Code Execution via malicious SFD file parsing</p> <p>fontforge: FontForge: Remote Code Execution via malicious SFD file parsing</p> https://cve.radiocsirt.org/vuln/rhsa-2026:7001 https://cve.radiocsirt.org/vuln/suse-su-2026:21375-1 <p>Security update for fontforge</p> <p>Security update for fontforge</p> https://cve.radiocsirt.org/vuln/suse-su-2026:21375-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-15270 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: fontforge, Ubuntu:Pro:18.04:LTS: fontforge, Ubuntu:20.04:LTS: fontforge, Ubuntu:22.04:LTS: fontforge, Ubuntu:24.04:LTS: fontforge, Ubuntu:25.10: fontforge, Ubuntu:26.04:LTS: fontforge</p> <p>FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: fontforge, Ubuntu:Pro:18.04:LTS: fontforge, Ubuntu:20.04:LTS: fontforge, Ubuntu:22.04:LTS: fontforge, Ubuntu:24.04:LTS: fontforge, Ubuntu:25.10: fontforge, Ubuntu:26.04:LTS: fontforge</p> <p>FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28563.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-15270 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0967 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux (fontforge) ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux (fontforge) ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0967