FontForge CVE-2025-50949

Exploitation requires a user to run FontForge v20230101 and process attacker-supplied input in the GUI such that the DlgCreate8 dialog routine (gdraw/gaskdlg.c) takes its error-return path, where the formatted buffer 'buf' is allocated but not freed; the patch confirms this by adding free(buf) before the return. The precise external input that drives DlgCreate8 to that error return is not described in the available sources. Limiting factors: user interaction is required (UI:R), the impact is a single small per-occurrence heap leak so appreciable availability impact depends on repeated triggering, and because FontForge is a local desktop editor the realistic access path is local file/input processing rather than a remote network service - contrary to the NVD AV:N rating.

Signals point consistently to a LOW real-world priority despite the moderate 6.5 base score. EPSS is 0.26% (18th percentile), there is no CISA KEV listing, and no public exploit or PoC reference is present in the input - the only references are the upstream patch (PR #5491) and a VulDB advisory. The vuln.today decision label is 'this_month,' i.e. routine patching rather than urgent. A key internal conflict undermines the NVD vector: it is scored AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, yet FontForge is a local desktop GUI font editor and the flaw lives in DlgCreate8 (gdraw/gaskdlg.c), a dialog-creation routine - this strongly implies local, file-open-driven exploitation, not a network vector, so AV:N should be verified against the GUI/local nature of the product. The A:H rating also looks inflated for CWE-401: the patch adds a single free(buf) on one error-return path, so each trigger leaks one small buffer, which realistically yields gradual, repetition-dependent memory consumption rather than immediate high availability loss. Net: a genuine but low-impact memory-leak bug, not an emergency; patch on a normal cycle.

An attacker supplies crafted input/font data to a victim running FontForge v20230101 in its GUI; when processing drives the DlgCreate8 dialog routine into its error-return path, a formatted buffer is allocated but never released (the fix in PR #5491 adds free(buf) before the return). Each occurrence leaks a small amount of heap, so meaningful impact requires the error path to be triggered repeatedly. No public exploit code or PoC reference is present in the available data.