CVE-2017-11575: Fontforge

High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days.

FontForge 20161012 is vulnerable to a buffer over-read in strnmatch (char.c) resulting in DoS or code execution via a crafted otf file, related to a call from the readttfcopyrights function in parsettf.c.

Affected products

• Fontforge Fontforge: version 20161012 only

Published 2017-07-23. Last modified 2026-06-17.