CVE-2025-15270: 
NixOS vulnerability analysis and mitigation

CVE-2025-15270 is a remote code execution vulnerability in FontForge caused by improper validation of array indices during SFD (Spline Font Database) file parsing. It affects FontForge version 2025-11-17 and was reported to the vendor on December 12, 2025, with ZDI publishing a 0-day advisory on December 29, 2025, after the vendor rejected the report. The vulnerability carries a CVSS v3.0 base score of 8.8 (High) (ZDI Advisory, Red Hat Bugzilla).

The root cause is improper validation of user-supplied data during SFD file parsing, classified as CWE-129 (Improper Validation of Array Index) and associated with CWE-787 (Out-of-bounds Write). The flaw allows a write operation past the end of an allocated array, which can be triggered when a user opens a malicious SFD file or visits a crafted web page that causes FontForge to process such a file. No authentication or elevated privileges are required; only user interaction (opening the file or visiting the page) is needed to trigger exploitation. The vulnerability was tracked internally by ZDI as ZDI-CAN-28563 (ZDI Advisory).

Successful exploitation allows a remote attacker to execute arbitrary code in the context of the current user running FontForge, resulting in high impacts to confidentiality, integrity, and availability. An attacker could achieve complete compromise of the affected user's system, enabling unauthorized data access, data modification, malware installation, and potential lateral movement within the network. The vulnerability does not require elevated privileges, making it accessible to any attacker who can deliver a malicious SFD file or lure a user to a crafted web page (ZDI Advisory, Red Hat Bugzilla).

A proof-of-concept exploit reference is available via the ZDI advisory published on December 29, 2025, as a 0-day after the vendor declined to address the report. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.396%, indicating a relatively low (but non-negligible) probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (ZDI Advisory).

1. Craft a malicious SFD file: Create a specially crafted SFD (Spline Font Database) file containing malformed data designed to trigger an out-of-bounds array write during FontForge's parsing routine.
2. Deliver the payload: Distribute the malicious SFD file via email attachment, file-sharing platform, or embed it in a web page that triggers FontForge to open the file (e.g., via a browser plugin or file association).
3. Induce user interaction: Social-engineer the target into opening the malicious SFD file directly in FontForge, or lure them to a malicious web page that causes FontForge to process the file.
4. Trigger the out-of-bounds write: When FontForge parses the malformed SFD file, the lack of proper array index validation causes a write past the end of an allocated buffer, corrupting adjacent memory.
5. Achieve code execution: Leverage the memory corruption to redirect program execution to attacker-controlled code, executing arbitrary commands with the privileges of the user running FontForge (ZDI Advisory).

• File System: Unexpected or unfamiliar .sfd files in user download directories, temporary folders, or email attachment staging areas; new or modified files in FontForge's working directory following a file open event.
• Process: Unusual child processes spawned by the FontForge process (e.g., shell interpreters, network utilities such as curl, wget, or nc); FontForge process crashing or exiting abnormally after opening an SFD file.
• Network: Unexpected outbound network connections originating from the FontForge process to unknown external IP addresses or domains, particularly shortly after a file open event.
• Logs: Application crash logs or core dumps associated with FontForge; system logs showing unexpected process creation by the FontForge user account.

Red Hat has issued multiple security errata addressing this vulnerability across RHEL 8, 9, 9.4 EUS, 9.6 EUS, 10, and 10.0 EUS (RHSA-2026:6628, RHSA-2026:6631, RHSA-2026:6635, RHSA-2026:7001, RHSA-2026:7677, RHSA-2026:8875). Mageia, openSUSE, Amazon Linux 2, and AlmaLinux have also released patches. Users should update FontForge to the latest patched version available for their distribution as the primary remediation. As a workaround where patching is not immediately possible, restrict user interaction with FontForge and prohibit opening SFD files from untrusted sources; implement network controls to block access to potentially malicious pages (Red Hat Bugzilla, ZDI Advisory).

The Zero Day Initiative published the advisory as a 0-day on December 29, 2025, after the FontForge vendor rejected the vulnerability report, stating that only pull requests containing fixes would be considered — an unusual response that drew attention to the vendor's disclosure posture. Red Hat promptly tracked and addressed the issue across multiple RHEL versions, issuing six separate errata by late April 2026. Coverage appeared on security news aggregators and community platforms including Bluesky and The Hacker Wire shortly after disclosure (ZDI Advisory, Red Hat Bugzilla).