CVE-2025-50949: 
NixOS vulnerability analysis and mitigation

FontForge version 20230101 was discovered to contain a memory leak vulnerability (CVE-2025-50949) in the component DlgCreate8. The vulnerability was identified in October 2025 and affects all FontForge installations up to and including version 20230101 (NVD, Ubuntu).

The vulnerability is characterized as a memory leak issue in the DlgCreate8 function. According to the LeakSanitizer analysis, there is a direct leak of 40 bytes in one object allocated through the malloc interceptor. The vulnerability has been assigned a CVSS 3.1 base score of 6.5 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Ubuntu).

The primary impact of this vulnerability is potential Denial of Service (DoS) due to memory resource exhaustion. The CVSS scoring indicates high impact on availability while maintaining no impact on confidentiality or integrity of the system (GitHub).

A fix for this vulnerability has been implemented and merged into the FontForge master branch through pull request #5491. Users are advised to upgrade to versions after the fix implementation or use the current master branch version (GitHub).