What’s Vulnerable › Vulnerabilities

CVE-2020-25690

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-02-23 · updated 2026-06-17
• Weakness: CWE-119

Description

An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Affected products

• FontForge: before 20200314 — fixed in 20200314

How to fix

Upgrade to a fixed version: FontForge 20200314. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1893188
• https://bugzilla.redhat.com/show_bug.cgi?id=1893188

Get alerted when CVE-2020-25690 or the next vulnerability affects your stack