High severity · published Dec 14, 2017
CVE-2017-17521
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to…
8.8
CVSS
1.8%
EPSS
No
On KEV
Description
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fontforge · Fontforge
through 20170731 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-17521
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-17521
Issue Tracking
https://security-tracker.debian.org/tracker/CVE-2017-17521
More from Fontforge
9.8
CVE-2019-15785
FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c
8.8
CVE-2025-15280
FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability
8.8
CVE-2025-15275
FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
8.8
CVE-2025-15274
FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
8.8
CVE-2025-15273
FontForge PFB File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability