CVE-2017-11568

What it actually does

Heap-based buffer over-read in PSCharStringToSplines (psread.c) when parsing PostScript charstrings inside OpenType fonts, allowing out-of-bounds memory access that can result in denial of service or arbitrary code execution.

Why it matters to the business

Systems or workflows that render or edit fonts (design tools, document processors, build pipelines) can be crashed or compromised by a single malicious font file, leading to downtime, data loss, or full machine takeover in environments that handle untrusted fonts.

How an attack unfolds

An attacker crafts an OpenType font containing a malformed PostScript charstring, delivers the file to a victim, and waits for the victim to open the file in FontForge; the parser then performs an out-of-bounds read that can be leveraged for code execution.

How to fix it

Upgrade FontForge to a version released after 20161012 that contains the bounds check fix; if an upgrade path is unavailable, isolate FontForge from untrusted fonts and replace it with a maintained alternative in any automated pipelines.

How to confirm the fix worked

Confirm FontForge version is newer than 20161012; test by opening a known-good crafted OTF sample in a sandboxed instance and verify the process does not crash or exhibit abnormal memory access.

Typical attack path

1. Craft malicious OTF file with oversized or malformed PostScript charstring
2. Host or email the file to the target environment
3. Victim opens the file directly in FontForge or via an automated font-processing workflow
4. PSCharStringToSplines reads beyond allocated buffer
5. Attacker-controlled data influences control flow or causes crash

How to detect it

Search application and system logs for FontForge crashes or segmentation faults triggered by OTF file opens; inspect process memory dumps for evidence of out-of-bounds reads during PSCharStringToSplines calls.

• FontForge process crash on OTF open
• psread.c:PSCharStringToSplines in stack trace
• heap buffer over-read in font parsing

What your security team should do

• Immediately block or sandbox any use of FontForge on untrusted font files
• Replace FontForge in build and CI systems with a current, supported font tool
• Add file-type sandboxing or conversion steps before any font reaches FontForge
• Monitor EPSS trend and re-evaluate if exploit code appears