FontForge PFB File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability

A stack-based buffer overflow vulnerability allowing remote code execution has been identified in FontForge. This issue arises from improper validation of user-supplied data length when parsing PFB files, leading to arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious PFB file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running under the user's privileges.

Remediation

No specific patch is available. Users are advised to limit interactions with FontForge, especially regarding PFB files.