CVE-2025-50951: Medium severity FontForge FontForge vulnerability
Published Oct 23, 2025
·Updated
FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8copy function at /fontforge/sfd.c.
Affected Software
6 affected components
FontForge FontForge
FontForge FontForge=2023-01-01
debian/fontforge*
debian/fontforge*
debian/fontforge*
debian/fontforge<=1:20230101~dfsg-1.1~deb12u1, <=1:20230101~dfsg-4, <=1:20251009+git20260808~dfsg-3
Remediation
Patch Available
Event History
Oct 23, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·04:16 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-50951?
CVE-2025-50951 has been classified as a moderate severity vulnerability due to its potential for causing resource exhaustion.
2
How do I fix CVE-2025-50951?
To fix CVE-2025-50951, update FontForge to a version where the memory leak has been addressed, as indicated in the latest release notes.
3
What is the impact of CVE-2025-50951?
The impact of CVE-2025-50951 is a memory leak that could lead to performance degradation and possible denial of service.
4
Which versions of FontForge are affected by CVE-2025-50951?
CVE-2025-50951 affects FontForge version v20230101 and potentially earlier versions.
5
What function contains the memory leak in CVE-2025-50951?
The memory leak in CVE-2025-50951 is found in the utf7toutf8_copy function located in /fontforge/sfd.c.