CVE-2017-17521: Fontforge

High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days.

uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.

Affected products

• Fontforge Fontforge: up to and including 20170731

Published 2017-12-14. Last modified 2026-06-17.