CVE-2017-11575: FontForge 20161012 is vulnerable to a buffer over-read in strnmatch (char.c) resulting in DoS or code execu...

Security readout for executives and security teams

This CVE affects FontForge, a font editing and conversion tool. A specially crafted OTF font file can trigger memory over-read behavior that the CVE record says may cause denial of service or code execution. Business risk is highest where FontForge processes fonts from customers, users, suppliers, or the internet. Exposure is likely limited to systems with FontForge 20161012 or related packaged builds that open or batch-process untrusted OTF files. Workstations, build pipelines, conversion services, and content-processing jobs are more relevant than servers with no font-processing workflow. Prioritize remediation if FontForge is used in automated font ingestion, conversion, publishing, or customer upload workflows. If FontForge is only used manually on trusted internal files, urgency is lower, but patching remains appropriate because code execution is reported as a possible impact. Mitigation focus: Apply FontForge updates from Debian DSA-3958 or relevant vendor guidance.; Avoid processing untrusted OTF files until the toolchain is patched.; Restrict automated FontForge jobs to trusted font sources..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.