fontforge (AlmaLinux:8) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:8 package fontforge, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (8)

• CVE-2020-25690 — CVSS 8.8 (high): An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount…
• CVE-2020-5395 — CVSS 8.8 (high): FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c.
• CVE-2025-15269 — CVSS 8.8 (high): FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute…
• CVE-2025-15270 — CVSS 8.8 (high): FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote…
• CVE-2025-15275 — CVSS 8.8 (high): FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
• CVE-2025-15279 — CVSS 7.8 (high): FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote…
• CVE-2024-25082 — CVSS 6.5 (medium): Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
• CVE-2024-25081 — CVSS 4.2 (medium): Splinefont in FontForge through 20230101 allows command injection via crafted filenames.