CVE-2025-15278: 
NixOS vulnerability analysis and mitigation

CVE-2025-15278 is an integer overflow vulnerability in FontForge's XBM file parsing component (GUtils) that allows remote attackers to execute arbitrary code on affected installations. The flaw was discovered by researcher volticks (@movx64) and reported to the vendor on August 21, 2025; after the vendor rejected the report, ZDI published it as a 0-day advisory on December 29, 2025. The affected version is FontForge 20251009 (commit 88de9b7dc76fbdef9069b7664ecc280f1c15ba2f). It carries a CVSS v3.0 base score of 7.8 (High) (ZDI Advisory, Red Hat Bugzilla).

The root cause is an integer overflow or wraparound (CWE-190) in FontForge's XBM file pixel-parsing logic within the GUtils component. When processing a maliciously crafted XBM file, the application fails to properly validate user-supplied dimension or pixel count data, causing an integer overflow that occurs before a buffer is allocated — resulting in an undersized heap buffer. An attacker exploits this by crafting a malicious XBM file (or embedding it in a malicious web page) and tricking a user into opening it with FontForge, after which the overflow can be leveraged to achieve arbitrary code execution in the context of the FontForge process. The attack vector is local (the file must be opened by the user), requires no privileges, but does require user interaction (ZDI Advisory).

Successful exploitation grants an attacker arbitrary code execution in the context of the FontForge process, resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker could read sensitive files accessible to the user running FontForge, modify or destroy data, or use the compromised process as a foothold for further lateral movement within the environment. The scope is limited to the current process and user context, but on systems where FontForge is used to process untrusted font or image files, the risk of data exposure and system compromise is significant (ZDI Advisory, Red Hat Bugzilla).

A proof-of-concept exploit reference exists via the ZDI advisory (ZDI-CAN-27865), published as a 0-day on December 29, 2025, after the FontForge vendor rejected the vulnerability report. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.046% (very low probability of exploitation in the near term). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (ZDI Advisory).

1. Craft a malicious XBM file: Create an XBM file with manipulated width/height or pixel count values designed to trigger an integer overflow in FontForge's GUtils XBM parsing code, resulting in an undersized heap buffer allocation.
2. Deliver the payload: Host the malicious XBM file on a web page or distribute it via email, file sharing, or other social engineering channels targeting FontForge users.
3. Induce user interaction: Trick the target user into opening the malicious XBM file with FontForge (e.g., by disguising it as a legitimate font resource or bitmap asset).
4. Trigger the overflow: When FontForge parses the XBM file, the integer overflow occurs before buffer allocation, leading to a heap buffer overflow condition.
5. Achieve code execution: Exploit the resulting memory corruption to redirect execution flow and run arbitrary code in the context of the FontForge process, potentially enabling data theft, file manipulation, or further system compromise (ZDI Advisory).

• File System: Unexpected or anomalous XBM files in directories used by FontForge; newly created or modified files in the user's home directory or FontForge working directories following XBM file processing.
• Process: Unusual child processes spawned by the FontForge process (e.g., shell interpreters, network utilities such as curl, wget, or nc); FontForge process crashing or exiting abnormally after opening an XBM file.
• Network: Unexpected outbound network connections originating from the FontForge process, particularly to unknown external IP addresses, shortly after opening an XBM file.
• Logs: Application crash logs or core dumps associated with FontForge; system logs showing unexpected process creation under the user account running FontForge.

The FontForge vendor rejected the original vulnerability report and has not released an official patch; as of the advisory date, no fixed version is available directly from FontForge. Red Hat has opened a tracking bug (BZ#2426433) and downstream package maintainers may release patched builds — users should monitor their Linux distribution's package repositories for updates (Red Hat Bugzilla). The primary mitigation recommended by ZDI is to restrict user interaction with FontForge, specifically preventing users from opening untrusted or externally sourced XBM files. Organizations should consider disabling or isolating FontForge installations where exposure to untrusted files is possible, and apply any available distribution-level patches promptly (ZDI Advisory).

The vulnerability was disclosed as a 0-day by ZDI on December 29, 2025, after the FontForge maintainers rejected the report, stating they would only consider pull requests containing fixes — an unusual response that drew attention in the security community. The disclosure was noted by security aggregators including TheHackerWire, CIRCL Vulnerability Lookup, and INCIBE-CERT. Social media posts on Mastodon and Bluesky highlighted the 0-day status and vendor non-cooperation. No formal public statement from the FontForge project has been issued in response to the advisory (ZDI Advisory).