CVE-2025-15279: 
NixOS vulnerability analysis and mitigation

CVE-2025-15279 is a heap-based buffer overflow vulnerability in FontForge's BMP file parsing functionality, specifically within the GUtils component during pixel parsing. It allows remote attackers to execute arbitrary code on affected systems when a user opens a malicious BMP file or visits a malicious page. The vulnerability was reported to the vendor on July 23, 2025, and publicly disclosed as a 0-day advisory on December 29, 2025, after the FontForge vendor rejected the report. It affects FontForge version 20251009 and carries a CVSS v3.0 base score of 7.8 (High) (ZDI Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow): FontForge fails to properly validate the length of user-supplied data before copying it into a heap-based buffer during BMP pixel parsing. An attacker crafts a malicious BMP file with oversized pixel data that overflows the heap buffer, potentially enabling control of program execution flow. Exploitation requires local access in the sense that the attack vector is local (the file must be opened by the user), but the attacker can deliver the malicious file remotely via a webpage or email attachment. The vulnerability was tracked internally by ZDI as ZDI-CAN-27517 (ZDI Advisory).

Successful exploitation allows an attacker to execute arbitrary code in the context of the current user running FontForge, resulting in high confidentiality, integrity, and availability impact. This could lead to complete compromise of the affected user's session, unauthorized data access, file manipulation, and potential lateral movement if the compromised account has elevated privileges. The scope is limited to the affected system and user context, with no privilege escalation beyond the current user implied by the CVSS scoring (ZDI Advisory, Red Hat Bugzilla).

A proof-of-concept advisory is publicly available via the Zero Day Initiative (published December 29, 2025), but no evidence of in-the-wild exploitation has been reported as of the time of disclosure (ZDI Advisory). The vulnerability was published as a 0-day because the FontForge vendor rejected the report, stating only pull requests with fixes would be considered. The EPSS score is approximately 0.042% (0.000420), indicating a low probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

1. Craft a malicious BMP file: Create a specially crafted BMP file with oversized or malformed pixel data that exceeds the expected buffer length in FontForge's GUtils BMP parsing routine.
2. Deliver the payload: Host the malicious BMP file on a web page or distribute it via email/file sharing to the target user, leveraging social engineering to encourage opening the file.
3. Trigger user interaction: The target user opens the malicious BMP file in FontForge (e.g., by importing it as a font background or opening it directly within the application).
4. Trigger heap overflow: FontForge's BMP pixel parsing code copies the oversized user-supplied data into a fixed-size heap buffer without length validation, causing a heap-based buffer overflow.
5. Achieve code execution: By carefully controlling the overflow data, the attacker overwrites heap metadata or function pointers to redirect execution flow, achieving arbitrary code execution in the context of the current user (ZDI Advisory).

• File System: Unexpected or suspicious BMP files in user download directories, temporary folders, or font project directories; new or modified files in FontForge working directories following a BMP file open event.
• Process: Unusual child processes spawned by the FontForge process (e.g., shell interpreters, network utilities like curl, wget, or python); FontForge process crashing or exhibiting abnormal memory usage.
• Network: Outbound network connections initiated by the FontForge process to unknown or unexpected external IP addresses, particularly following the opening of a BMP file.
• Logs: Application crash logs or core dumps associated with FontForge referencing BMP parsing or GUtils components; OS-level heap corruption error messages linked to the FontForge process.

Red Hat has released multiple errata addressing this vulnerability across supported RHEL versions: RHSA-2026:2039 (RHEL 9), RHSA-2026:2230 (RHEL 10), RHSA-2026:2232 (RHEL 10.0 EUS), RHSA-2026:2213 (RHEL 9.6 EUS), RHSA-2026:2566 (RHEL 9.4 EUS), RHSA-2026:7677 (RHEL 8), and RHSA-2026:8937 (RHEL 7 ELS) (Red Hat Bugzilla). Fedora 42 and 43 updates are also available. As a workaround where patching is not immediately possible, restrict user access to FontForge and educate users not to open BMP files from untrusted sources. ZDI notes that the only salient mitigation is to restrict interaction with the product until a fix is applied (ZDI Advisory).

The vulnerability was disclosed as a 0-day by ZDI on December 29, 2025, after the FontForge vendor rejected the report and declined to engage with the coordinated disclosure process, requiring submitters to provide pull requests with fixes rather than accepting vulnerability reports. This vendor response drew attention in the security community, with mentions on Mastodon and Bluesky highlighting the unusual disclosure circumstances (ZDI Advisory). Multiple Linux distribution security teams (Red Hat, Fedora, Rocky Linux, AlmaLinux, Mageia, Amazon Linux) responded promptly with patches, indicating broad downstream concern about the vulnerability's impact on packaged FontForge installations.