Log in Start free

Vulnerability · Published Feb 23, 2021 · Assigned by redhat

CVE-2020-25690

High 8.8

In plain English

A high-severity memory corruption in fontforge. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.3%top 28.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8fontforge20170731-15.el8ALSA-2020:4844
Ubuntu:22.04:LTSfontforgeno fix listedUBUNTU-CVE-2020-25690
Ubuntu:24.04:LTSfontforgeno fix listedUBUNTU-CVE-2020-25690
Ubuntu:25.10fontforgeno fix listedUBUNTU-CVE-2020-25690
Ubuntu:26.04:LTSfontforgeno fix listedUBUNTU-CVE-2020-25690
Ubuntu:26.10fontforgeno fix listedUBUNTU-CVE-2020-25690

Affected products (as reported)

VendorProductVersions
n/a fontforge fontforge before 20200314

Weakness: CWE-119

References