Bug 2406046 (CVE-2025-50951) - CVE-2025-50951 fontforge: Fontforge memory leak
Summary: CVE-2025-50951 fontforge: Fontforge memory leak
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2025-50951
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2406132 2406134
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-10-23 16:01 UTC by OSIDB Bzimport
Modified: 2025-10-28 08:57 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-10-28 08:57:32 UTC
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-10-23 16:01:37 UTC 
FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.
Comment 2 Parag Nemade 2025-10-28 08:57:32 UTC 
The code that introduced this CVE that code does not exist in released reported version of fontforge-20230101.
That code is added later in commit https://github.com/fontforge/fontforge/commit/ba9f786e09ef58eae512e488a71469656fe4a269#diff-16b1c2155649c22d7b2979879042035b4d125ade5143275ca812fc9900289c3e
Note You need to log in before you can comment on or make changes to this bug.