CVE-2017-11574

Name of the Vulnerable Software and Affected Versions FontForge version 20161012

Description The issue is related to a heap-based buffer overflow in the readcffset function, located in parsettf.c, which can be triggered by a crafted otf file. This can result in a denial of service (DoS) or potentially allow for code execution.

Recommendations For FontForge version 20161012, consider avoiding the use of crafted otf files until a patch is available. As a temporary workaround, restrict the processing of otf files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.