CVE-2025-15275: 
NixOS vulnerability analysis and mitigation

CVE-2025-15275 is a heap-based buffer overflow vulnerability in FontForge's SFD (Spline Font Database) file parser that allows remote attackers to execute arbitrary code on affected installations. The flaw was reported to the vendor on December 12, 2025, and publicly disclosed as a zero-day advisory on December 29, 2025, after the FontForge maintainers rejected the report. The affected version is FontForge 2025-11-17 (commit aca4f524c6cb14cdc7bc4cd493492a33f5154797). It carries a CVSS v3.0 base score of 8.8 (High) (ZDI Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow): FontForge fails to validate the length of user-supplied data before copying it into a heap-allocated buffer during SFD file parsing. An attacker can craft a malicious SFD file (or host it on a web page) such that when a victim opens it in FontForge, the oversized data overflows the heap buffer, enabling controlled memory corruption and ultimately arbitrary code execution in the context of the current user. Exploitation requires user interaction — the victim must open a malicious file or visit a page that triggers FontForge to process a crafted SFD document. The vulnerability was tracked internally by ZDI as ZDI-CAN-28543 (ZDI Advisory).

Successful exploitation grants an attacker full code execution with the privileges of the user running FontForge, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive files accessible to the user, modify or delete data, install malware, or use the compromised session as a foothold for lateral movement within the network. Because FontForge is commonly used by font designers and typographers — including in automated font-processing pipelines — the attack surface extends to any environment where untrusted SFD files may be processed (ZDI Advisory, Red Hat Bugzilla).

A proof-of-concept advisory was published by Zero Day Initiative on December 29, 2025, making technical details publicly available, though no weaponized exploit kit or in-the-wild exploitation has been confirmed as of the time of writing. The EPSS score is approximately 0.35%, reflecting a currently low but non-negligible probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (ZDI Advisory).

1. Craft a malicious SFD file: Create a specially crafted FontForge SFD file containing an oversized data field in a section parsed by FontForge's SFD reader, designed to overflow the heap buffer when the length is not validated.
2. Deliver the payload: Host the malicious SFD file on an attacker-controlled web page or distribute it via email/file-sharing platforms, relying on social engineering to convince the target to open it with FontForge.
3. Trigger parsing: When the victim opens the file in FontForge (or a web page triggers FontForge to process it), the SFD parser copies the oversized user-supplied data into a fixed-size heap buffer without bounds checking.
4. Exploit heap corruption: The overflow corrupts adjacent heap metadata or function pointers, allowing the attacker to redirect execution flow to attacker-controlled shellcode or a ROP chain.
5. Achieve code execution: Arbitrary code runs in the context of the current user, enabling reverse shell establishment, credential theft, or further post-exploitation activity (ZDI Advisory).

• File System: Unexpected or newly created SFD files in user download directories or temporary folders; FontForge crash dump files (core dumps) indicating abnormal termination during file parsing.
• Process: Unusual child processes spawned by the FontForge process (e.g., bash, sh, curl, wget, python) immediately after opening an SFD file; FontForge process making unexpected outbound network connections.
• Network: Outbound connections from a workstation to unknown external IPs shortly after a user opens an SFD file; DNS queries for unfamiliar domains originating from the FontForge process.
• Logs: Application crash logs or OS-level segfault/signal logs referencing the FontForge binary; audit logs showing FontForge spawning shell interpreters or network utilities.

The FontForge vendor initially rejected the vulnerability report, but downstream Linux distributions have since issued patched packages. Red Hat has addressed the issue across multiple RHEL versions via errata RHSA-2026:2039 (RHEL 9), RHSA-2026:2230 (RHEL 10), RHSA-2026:2232 (RHEL 10 EUS), RHSA-2026:2213 (RHEL 9.6 EUS), RHSA-2026:2566 (RHEL 9.4 EUS), RHSA-2026:7677 (RHEL 8), and RHSA-2026:8937 (RHEL 7 ELS). Fedora, Rocky Linux, AlmaLinux, Mageia, Amazon Linux 2, and SUSE have also released updated FontForge packages. Users should update to the patched version provided by their distribution immediately. As a workaround where patching is not immediately possible, restrict FontForge usage to trusted SFD files only, implement application whitelisting to limit FontForge execution, and educate users not to open SFD files from untrusted sources (Red Hat Bugzilla, ZDI Advisory).

The Zero Day Initiative published the advisory as a 0-day on December 29, 2025, after the FontForge maintainers declined to address the report, stating they would only consider pull requests containing fixes — a response that drew attention from the security community. The Hacker Wire and related security news outlets covered the disclosure on social media platforms including Mastodon and Bluesky, highlighting the vendor's rejection of the coordinated disclosure process. The case illustrates ongoing challenges with open-source project maintainers engaging with external vulnerability reporters (ZDI Advisory).