Fedora 42 fontforge Critical Remote Execution Fix FEDORA-2026

FontForge (former PfaEdit) is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Update Information : Resolves: CVE-2025-15279, CVE-2025-15275, CVE-2025-15269

FontForge (former PfaEdit) is a font editor for outline and bitmap

fonts. It supports a range of font formats, including PostScript

(ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType

(Type2) and CID-keyed fonts.

Resolves: CVE-2025-15279, CVE-2025-15275, CVE-2025-15269

* Thu Jan 22 2026 Parag Nemade - 20230101-18 - Resolves: CVE-2025-15279 - Resolves: CVE-2025-15275 - Resolves: CVE-2025-15269

* Thu Jan 22 2026 Parag Nemade - 20230101-18 - Resolves: CVE-2025-15279 - Resolves: CVE-2025-15275 - Resolves: CVE-2025-15269

[ 1 ] Bug #2426577 - CVE-2025-15269 fontforge: FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability [fedora-42] [ 2 ] Bug #2426589 - CVE-2025-15275 fontforge: FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability [fedora-42] [ 3 ] Bug #2426593 - CVE-2025-15279 fontforge: FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability [fedora-42]

[ 1 ] Bug #2426577 - CVE-2025-15269 fontforge: FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability [fedora-42] [ 2 ] Bug #2426589 - CVE-2025-15275 fontforge: FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability [fedora-42] [ 3 ] Bug #2426593 - CVE-2025-15279 fontforge: FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability [fedora-42]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-9b8156c2a9' at the command line. For more information, refer to the dnf documentation available at