FontForge, a font editor included in Red Hat Enterprise Linux 7 Extended Lifecycle Support, contains three security vulnerabilities that allow remote or arbitrary code execution. The vulnerabilities are a heap-based buffer overflow in BMP file parsing (CVE-2025-15279), a use-after-free in SFD file parsing (CVE-2025-15269), and a buffer overflow in SFD file parsing (CVE-2025-15275). These vulnerabilities are rated with high security impact by Red Hat Product Security. An updated FontForge package has been released by Red Hat to fix these issues. The advisory references Red Hat Security Advisory RHSA-2026:8937 and provides package updates for multiple architectures.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code remotely on affected systems running vulnerable versions of FontForge. This could lead to full system compromise depending on the privileges of the FontForge process. The vulnerabilities affect Red Hat Enterprise Linux 7 Extended Lifecycle Support versions. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released an important security update for FontForge in Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these vulnerabilities. Users should apply the update as described in Red Hat advisory RHSA-2026:8937 and the related article https://access.redhat.com/articles/11258. Applying this update will remediate the heap-based buffer overflow, use-after-free, and buffer overflow vulnerabilities in FontForge. No additional mitigation steps are indicated by the vendor.