FontForge Use-After-Free Vulnerability in SFD File Parsing Leading to Remote Code Execution

A use-after-free vulnerability has been identified in FontForge within the SFD file parsing component. This issue allows remote attackers to execute arbitrary code on affected installations. The vulnerability arises from improper validation of object existence before performing operations, creating an opportunity for exploitation. User interaction is required, as the target must open a malicious SFD file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, executed in the context of the current user.

Remediation

No official patch is available. Users are advised to limit interactions with the product.