Package
fontforge
Component
fontforge
Latest update
7.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Upstream has no fix and has declined this class of report: fontforge/fontforge#5706 is the ZDI meta-issue, where the maintainers state they do not prioritize security reports on untrusted input files and will only take test-passing PRs. ZDI has not published the proof of concept for this id (only 4 of the 12 reports are public on SourceForge), so the affected parser path is not known precisely. Of the 12-CVE batch, 4 now have upstream fixes, carried in os/fontforge from 20251009-r6 (CVE-2025-15269, -15270, -15275, -15279); this one is not among them. Revisit when upstream releases after 20251009 or when a PoC becomes public.
Status
Impact
Waiting on upstream to publish a fixed version for this vulnerability.
Status