CVE-2025-15277

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15277", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2025-12-29T20:02:11.712Z", "datePublished": "2025-12-31T06:59:29.183Z", "dateUpdated": "2025-12-31T16:22:17.744Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2025-12-31T06:59:29.183Z"}, "title": "FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "descriptions": [{"lang": "en", "value": "FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of scanlines within SGI files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27920."}], "affected": [{"vendor": "FontForge", "product": "FontForge", "versions": [{"version": "88de9b7dc76fbdef9069b7664ecc280f1c15ba2f", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1186/", "name": "ZDI-25-1186", "tags": ["x_research-advisory"]}], "dateAssigned": "2025-12-29T20:02:11.743Z", "datePublic": "2025-12-29T22:54:57.830Z", "source": {"lang": "en", "value": "volticks (@movx64 on twitter)"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-31T16:22:10.876749Z", "id": "CVE-2025-15277", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-31T16:22:17.744Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15277", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-31T16:22:10.876749Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-31T16:22:14.712Z"}}], "cna": {"title": "FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "source": {"lang": "en", "value": "volticks (@movx64 on twitter)"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "FontForge", "product": "FontForge", "versions": [{"status": "affected", "version": "88de9b7dc76fbdef9069b7664ecc280f1c15ba2f"}], "defaultStatus": "unknown"}], "datePublic": "2025-12-29T22:54:57.830Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1186/", "name": "ZDI-25-1186", "tags": ["x_research-advisory"]}], "dateAssigned": "2025-12-29T20:02:11.743Z", "descriptions": [{"lang": "en", "value": "FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of scanlines within SGI files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27920."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2025-12-31T06:59:29.183Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15277", "state": "PUBLISHED", "dateUpdated": "2025-12-31T16:22:17.744Z", "dateReserved": "2025-12-29T20:02:11.712Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2025-12-31T06:59:29.183Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "FontForge", "vendor": "FontForge", "versions": [{"status": "affected", "version": "88de9b7dc76fbdef9069b7664ecc280f1c15ba2f"}]}], "source": "zdi-disclosures@trendmicro.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fontforge:fontforge:20251009:*:*:*:*:*:*:*", "matchCriteriaId": "1C318A12-82C3-4AD4-9BDF-A7B485A20A38", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of scanlines within SGI files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27920."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo por desbordamiento de b\u00fafer basado en mont\u00edculo en el an\u00e1lisis de archivos SGI de FontForge GUtils. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de FontForge. Se requiere interacci\u00f3n del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una p\u00e1gina maliciosa o abrir un archivo malicioso.\n\nLa falla espec\u00edfica existe dentro del an\u00e1lisis de las l\u00edneas de exploraci\u00f3n en archivos SGI. El problema resulta de la falta de validaci\u00f3n adecuada de la longitud de los datos proporcionados por el usuario antes de copiarlos a un b\u00fafer basado en mont\u00edculo. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del proceso actual. Fue ZDI-CAN-27920."}], "id": "CVE-2025-15277", "lastModified": "2026-06-17T08:37:30.987", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15277", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-31T16:22:10.876749Z", "version": "2.0.3"}}]}, "published": "2025-12-31T07:15:52.037", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1186/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{"bugzilla": {"description": "fontforge: FontForge: Remote Code Execution via malicious SGI file parsing", "id": "2426425", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426425"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-122", "details": ["FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\nThe specific flaw exists within the parsing of scanlines within SGI files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27920.", "A flaw was found in FontForge. This vulnerability, a heap-based buffer overflow, allows a remote attacker to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious SGI (Silicon Graphics Image) file, which triggers improper data length validation during scanline parsing, leading to memory corruption."], "mitigation": {"lang": "en:us", "value": "Avoid opening untrusted SGI (Silicon Graphics Image) files with FontForge. If FontForge is not essential for system operation, consider removing the package to eliminate the attack surface.\nTo remove FontForge:\nFor Red Hat Enterprise Linux 7 and 8:\n`sudo yum remove fontforge`\nFor Red Hat Enterprise Linux 9 and 10, and Fedora:\n`sudo dnf remove fontforge`\nRemoving FontForge may affect other applications that depend on its functionality. A system restart may be required to ensure all related processes are terminated."}, "name": "CVE-2025-15277", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "fontforge", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "fontforge", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "fontforge", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "fontforge", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "fontforge", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-31T06:59:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-15277\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-15277\nhttps://www.zerodayinitiative.com/advisories/ZDI-25-1186/"], "statement": "This vulnerability is rated Important for Red Hat products. Exploitation requires user interaction, specifically opening a specially crafted SGI file in FontForge. This impacts systems where FontForge is installed and used to process untrusted image files, such as in desktop environments.", "threat_severity": "Important"}

{"created": "2026-01-05T10:17:51.893012+00:00", "updated": "2026-01-05T10:17:51.893038+00:00", "vendors": ["fontforge", "fontforge$PRODUCT$fontforge"]}