CVE-2015-3905: Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers t...

Security readout for executives and security teams

CVE-2015-3905 affects t1utils, a Type 1 font utility package. A crafted font file can crash the tool and may allow arbitrary code execution. Business risk is mainly where servers, build systems, or user-facing workflows process untrusted font files using vulnerable t1utils versions before 1.39. Exposure is likely limited to systems with t1utils before 1.39 installed and reachable through workflows that parse externally supplied Type 1 font files. General desktops or servers without t1utils, or without untrusted font processing, are less exposed. Treat as a targeted remediation item, not an emergency. Prioritize systems that automatically process customer, partner, or internet-supplied fonts. The patch path is mature, and there is no supplied evidence of active exploitation. Mitigation focus: Upgrade t1utils to version 1.39 or a vendor-fixed package.; Follow applicable distribution guidance from Ubuntu, Gentoo, Debian, or Red Hat.; Avoid processing untrusted font files with vulnerable t1utils versions..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.