CVE-2025-15269: 
NixOS vulnerability analysis and mitigation

CVE-2025-15269 is a use-after-free remote code execution vulnerability in FontForge's SFD (Spline Font Database) file parser, tracked as ZDI-CAN-28564. It affects FontForge version 2025-11-17 and was publicly disclosed on December 29, 2025, as a zero-day advisory after the vendor rejected the vulnerability report. The vulnerability carries a CVSS v3.0 base score of 8.8 (High) (ZDI Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-416 (Use After Free) and exists within FontForge's SFD file parsing logic, where the application fails to validate the existence of an object before performing operations on it, resulting in a use-after-free condition (ZDI Advisory). An attacker can exploit this by crafting a malicious SFD file or a web page that triggers the parsing of such a file, requiring the target user to open the file or visit the malicious page. No privileges are required on the attacker's side, and attack complexity is low, making this straightforward to exploit once a suitable lure is in place (ZDI Advisory). ZDI reported the issue to the vendor on December 12, 2025, but the vendor rejected the report, stating only pull requests with fixes would be considered, leading ZDI to publish it as a 0-day on December 29, 2025 (ZDI Advisory).

Successful exploitation allows a remote attacker to execute arbitrary code in the context of the current user on affected FontForge installations, resulting in high confidentiality, integrity, and availability impacts (ZDI Advisory). This could lead to complete compromise of the user's credentials, data theft, system manipulation, and potential lateral movement within the network if the compromised account has broader access (Red Hat Bugzilla). The scope is limited to the current user context, but in environments where FontForge is used by privileged users or in automated font processing pipelines, the impact could be significantly amplified.

A proof-of-concept exploit reference is available via the Zero Day Initiative advisory published on December 29, 2025, though no evidence of active in-the-wild exploitation has been reported at this time (ZDI Advisory). The vulnerability was published as a 0-day due to vendor non-cooperation, meaning no official patch from the upstream FontForge project was available at the time of disclosure. The EPSS score is approximately 0.396%, indicating a relatively low but non-negligible probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

1. Craft a malicious SFD file: Create a specially crafted FontForge SFD (Spline Font Database) file that triggers the use-after-free condition during parsing — specifically by constructing object references that are freed and then accessed during the parsing routine.
2. Deliver the payload: Host the malicious SFD file on an attacker-controlled web server or distribute it via email/file-sharing as a seemingly legitimate font project file, relying on social engineering to get the target to open it.
3. Trigger user interaction: Lure the target user into opening the malicious SFD file with FontForge (e.g., by visiting a malicious page that initiates a download and open, or by sending the file directly).
4. Exploit the use-after-free: When FontForge parses the malicious SFD file, the lack of object existence validation causes a use-after-free condition, allowing the attacker to control freed memory and redirect execution flow.
5. Achieve code execution: The attacker's payload executes arbitrary code in the context of the current user, enabling actions such as dropping a reverse shell, exfiltrating data, or establishing persistence (ZDI Advisory).

• File System: Unexpected or suspicious .sfd files in user download directories, temporary folders, or font project directories; newly created executable files or scripts in user home directories following FontForge usage.
• Process: Unusual child processes spawned by the FontForge process (e.g., shell interpreters like /bin/bash, cmd.exe, network utilities like curl, wget, or powershell); FontForge crashing with segmentation faults or access violations in logs.
• Network: Outbound connections from the FontForge process or its parent to unexpected external IP addresses or domains, particularly shortly after opening an SFD file; DNS queries to newly registered or suspicious domains initiated by the FontForge process.
• Logs: Application crash logs or core dumps associated with FontForge referencing memory access violations; system audit logs showing FontForge spawning unexpected child processes or accessing sensitive files outside normal font directories.

Red Hat has issued multiple security errata addressing this vulnerability across RHEL 7 through RHEL 10, including RHSA-2026:2039 (RHEL 9), RHSA-2026:2230 (RHEL 10), RHSA-2026:2232 (RHEL 10.0 EUS), RHSA-2026:2213 (RHEL 9.6 EUS), RHSA-2026:2566 (RHEL 9.4 EUS), RHSA-2026:7677 (RHEL 8), and RHSA-2026:8937 (RHEL 7 ELS) (Red Hat Bugzilla). Fedora 42/43, Mageia, Amazon Linux 2, Rocky Linux, AlmaLinux, and SUSE have also released updated packages. As a workaround where patching is not immediately possible, ZDI recommends restricting user interaction with FontForge, preventing users from opening SFD files from untrusted or external sources, and disabling FontForge if it is not operationally essential (ZDI Advisory). Implementing application whitelisting and file-type filtering at the perimeter can further reduce exposure.

The vulnerability attracted attention in the security community primarily because it was published as a zero-day after the FontForge vendor rejected ZDI's report, stating they would only accept pull requests with fixes rather than vulnerability disclosures — an unusual vendor response that drew commentary on social media platforms including Mastodon and Bluesky (ZDI Advisory). Security news outlets including The Hacker Wire covered the disclosure, and the vulnerability was discussed across vulnerability tracking communities. The case highlights ongoing tensions between open-source project maintainers and coordinated vulnerability disclosure processes.