CVE-2017-17521

8.8 highEPSS 1.8%

High (8.8) in fontforge fontforge. EPSS 1.8% chance of exploitation in the next 30 days.

uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2017-12-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fontforge:fontforge

References

https://security-tracker.debian.org/tracker/CVE-2017-17521
https://security-tracker.debian.org/tracker/CVE-2017-17521

Check your stack JSON