RHSA-2026:7001HighCVSS 8.8

Red Hat Security Advisory: fontforge security update

Published
April 8, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (1)

CVE-2025-15270 →

📋 Description

CVE-2025-15270 — fontforge: FontForge: Remote Code Execution via malicious SFD file parsing

🎯 Affected products17

  • Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-0:20201107-7.el9_4.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-0:20201107-7.el9_4.i686 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-0:20201107-7.el9_4.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-0:20201107-7.el9_4.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-0:20201107-7.el9_4.src as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-0:20201107-7.el9_4.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-debuginfo-0:20201107-7.el9_4.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-debuginfo-0:20201107-7.el9_4.i686 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-debuginfo-0:20201107-7.el9_4.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-debuginfo-0:20201107-7.el9_4.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-debuginfo-0:20201107-7.el9_4.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-debugsource-0:20201107-7.el9_4.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-debugsource-0:20201107-7.el9_4.i686 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-debugsource-0:20201107-7.el9_4.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-debugsource-0:20201107-7.el9_4.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)
  • fontforge-debugsource-0:20201107-7.el9_4.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.4)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, users should avoid opening untrusted SFD (Spline Font Database) files with FontForge. If FontForge is not required, consider removing the `fontforge` package to eliminate the attack surface. To remove the package on Red Hat Enterprise Linux: `sudo yum remove fontforge` (for RHEL 6/7) `sudo dnf remove fontforge` (for RHEL 8/9/10 and Fedora) Removing this package may impact functionality that relies on FontForge.

🔗 References (4)