RHSA-2026:6628HighCVSS 8.8

Red Hat Security Advisory: fontforge security update

Published
April 6, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (1)

CVE-2025-15270 →

📋 Description

CVE-2025-15270 — fontforge: FontForge: Remote Code Execution via malicious SFD file parsing

🎯 Affected products17

  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-0:20201107-8.el9_7.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-0:20201107-8.el9_7.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-0:20201107-8.el9_7.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-0:20201107-8.el9_7.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-0:20201107-8.el9_7.src as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-0:20201107-8.el9_7.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-debuginfo-0:20201107-8.el9_7.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-debuginfo-0:20201107-8.el9_7.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-debuginfo-0:20201107-8.el9_7.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-debuginfo-0:20201107-8.el9_7.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-debuginfo-0:20201107-8.el9_7.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-debugsource-0:20201107-8.el9_7.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-debugsource-0:20201107-8.el9_7.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-debugsource-0:20201107-8.el9_7.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-debugsource-0:20201107-8.el9_7.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • fontforge-debugsource-0:20201107-8.el9_7.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, users should avoid opening untrusted SFD (Spline Font Database) files with FontForge. If FontForge is not required, consider removing the `fontforge` package to eliminate the attack surface. To remove the package on Red Hat Enterprise Linux: `sudo yum remove fontforge` (for RHEL 6/7) `sudo dnf remove fontforge` (for RHEL 8/9/10 and Fedora) Removing this package may impact functionality that relies on FontForge.

🔗 References (4)