FontForge GUtils BMP File Parsing Heap-Based Buffer Overflow Remote Code Execution Vulnerability

A heap-based buffer overflow vulnerability allowing remote code execution has been identified in FontForge. This issue arises from improper validation of user-supplied data length during BMP file pixel parsing, leading to arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious BMP file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running under the privileges of the current user.

Remediation

Users are advised to limit interactions with FontForge, especially regarding BMP files, to mitigate the risk of exploitation.