CVE-2017-11568

Name of the Vulnerable Software and Affected Versions FontForge version 20161012

Description The issue is related to a heap-based buffer over-read in the PSCharStringToSplines function, located in the psread.c file. This can be triggered by a crafted otf file, potentially resulting in denial of service or code execution.

Recommendations For FontForge version 20161012, consider avoiding the use of crafted otf files until a patch is available. As a temporary workaround, restrict the processing of otf files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.