CVE-2025-50949
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.
Risk Assessment
A memory leak can lead to resource exhaustion and application crash, causing denial of service.
Recommendation
Update FontForge to a version that fixes the memory leak or avoid using the vulnerable component.
Other vulnerabilities in FontForge
See all- CVE-2017-17521High
The uiutil.c file in FontForge through version 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
- CVE-2017-11577High
FontForge version 20161012 is vulnerable to a buffer over-read in getsid (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11575High
FontForge version 20161012 is vulnerable to a buffer over-read in the strnmatch function (char.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11574High
FontForge version 20161012 is vulnerable to a heap-based buffer overflow in the readcffset function (parsettf.c), which may lead to DoS attacks or code execution via a crafted otf file.
- CVE-2017-11573High
FontForge version 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11572High
FontForge version 20161012 is vulnerable to a heap-based buffer over-read in the readcfftopdicts function (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11571High
FontForge version 20161012 is vulnerable to a stack-based buffer overflow in the addnibble function (parsettf.c), potentially leading to DoS or code execution via a crafted otf file.
- CVE-2017-11570High
FontForge version 20161012 is vulnerable to a buffer over-read in umodenc (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11569High
FontForge version 20161012 is vulnerable to a heap-based buffer over-read in readttfcopyrights (parsettf.c), potentially leading to DoS or code execution via a crafted otf file.
- CVE-2017-11568High
FontForge version 20161012 is vulnerable to a heap-based buffer over-read in PSCharStringToSplines (psread.c), which may lead to DoS or code execution via a crafted otf file.
Original NVD description (English source)
FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS