CVE-2025-50949

EUVD-2025-35700
FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 14%
Debian logo
Debian Releases
Debian Product
Codename
fontforge
bookworm
unimportant
bookworm (security)
unimportant
bullseye
unimportant
bullseye (security)
unimportant
forky
unimportant
sid
unimportant
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
fontforge
bionic
needed
focal
needed
jammy
needed
noble
needed
plucky
ignored
questing
needed
resolute
needed
xenial
ignored
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
fontforge
Amazon Linux 2
0:20120731b-13.amzn2.0.3
fixed
Amazon Linux 2023
0:20201107-3.amzn2023.0.4
fixed
fontforge-debuginfo
Amazon Linux 2
0:20120731b-13.amzn2.0.3
fixed
Amazon Linux 2023
0:20201107-3.amzn2023.0.4
fixed
fontforge-debugsource
Amazon Linux 2023
0:20201107-3.amzn2023.0.4
fixed
fontforge-devel
Amazon Linux 2
0:20120731b-13.amzn2.0.3
fixed
Amazon Linux 2023
0:20201107-3.amzn2023.0.4
fixed
fontforge-doc
Amazon Linux 2023
0:20201107-3.amzn2023.0.4
fixed
Common Weakness Enumeration
References
https://github.com/fontforge/fontforge/pull/5491