GHSA-cgxg-jvf2-h7v5
Record from GitHub Advisory Database · Published December 31, 2025
FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of pixels within BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27517.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| fontforge | Wolfi | 20251009-r6 |
| fontforge | Chainguard | 20251009-r6 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| wolfi | fontforge | 0 |
| chainguard | fontforge | 0 |
Timeline
- Dec 31, 2025 CVE Published
- Apr 10, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-cgxg-jvf2-h7v5
vulnetix vdb fixes GHSA-cgxg-jvf2-h7v5Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-cgxg-jvf2-h7v5/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart