Skip to content
OpenAdvisories
High RHSA-2026:2566 5 CVEs

Red Hat Security Advisory: fontforge security update

Published Feb 12, 2026 · Updated Jul 9, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb fontforge 0:20201107-6.el9_4
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb fontforge-debuginfo 0:20201107-6.el9_4
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::crb fontforge-debugsource 0:20201107-6.el9_4

Vulnerabilities 5

  • High 8.8
    CVE-2025-15269

    FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability

    FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the …

    FontForge FontForge fontforge fontforge Debian Ubuntu
  • High 8.8
    CVE-2025-15275

    FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

    FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability …

    FontForge FontForge fontforge fontforge Debian Ubuntu
  • High 7.8
    CVE-2025-15279

    FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

    FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnera…

    FontForge FontForge fontforge fontforge Debian Ubuntu Wolfi
  • Medium 6.5
    CVE-2024-25082 Public exploit

    Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

    fontforge fontforge fontforge-doc Debian Ubuntu Wolfi
  • Medium 4.2
    CVE-2024-25081 Public exploit

    Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

    fontforge fontforge fontforge-doc Debian Ubuntu Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2266180
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2266181
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2426421
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2426423
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2426429
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2566.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-25081
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-25081
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-25081
  • article
    https://github.com/fontforge/fontforge/pull/5367
  • report
    https://access.redhat.com/security/cve/CVE-2024-25082
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-25082
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-25082
  • report
    https://access.redhat.com/security/cve/CVE-2025-15269
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-15269
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-15269
  • article
    https://www.zerodayinitiative.com/advisories/ZDI-25-1195/
  • report
    https://access.redhat.com/security/cve/CVE-2025-15275
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-15275
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-15275
  • article
    https://www.zerodayinitiative.com/advisories/ZDI-25-1189/
  • report
    https://access.redhat.com/security/cve/CVE-2025-15279
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-15279
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-15279
  • article
    https://www.zerodayinitiative.com/advisories/ZDI-25-1184/