Using the wrong font could be a major security problem — and possibly not for the reason you might think

News
By Craig Hale
published

Canva uncovers three CVEs concerning fonts

Fonts
(Image credit: Marek Levák / Unsplash)

An investigation by Canva deep dive into the world of font security has uncovered three unexpected vulnerabilities and revealed how choosing the wrong font could spell out a cybersecurity disaster.

In an effort to enhance the security of its tools, Canva has been researching less-explored attack surfaces, including fonts, which play an integral part in graphics processing.

A trio of vulnerabilities have been highlighted in a report entitled “Fonts are still a Helvetica of a Problem", with Canva ultimately declaring that the font landscape is actually quite rich in attack surfaces.

Canva is concerned about the font you use

The first vulnerability, tracked as CVE-2023-45139, was discovered in FontTools, a Python library for manipulating fonts. Canva found that when processing an SVG table to subset a font, FontTools could use an untrusted XML file, leading to an XML External Entity (XXE) vulnerability.

The researchers abused this vulnerability to produce a subsetted font containing an SVG table with an /etc/passwd payload. FontTools released a patch three days after being notified of the vulnerability in September 2023.

The other two vulnerabilities, CVE-2024-25081 and CVE-2024-25082, both rated at 4.2/10, were associated with naming conventions and font compression. Canva found the potential for command injection when dealing with filenames in tools like FontForge and ImageMagick. Both have also been addressed.

Acknowledging the timely work of open-source font software and tool maintainers, Canva noted that IT workers should “treat fonts like any other untrusted input” by implementing sandboxing and using tools like OpenType-Sanitizer.

This isn’t the first time that font security has been raised, with Google exploring similar issues nearly a decade ago, however with the increased prevalence and more severe consequences of cyber attacks, Canva’s recommendation that we pay attention to less obvious attack surfaces is a mighty sensible one.

More from TechRadar Pro

Craig Hale
Craig Hale

With several years’ experience freelancing in tech and automotive circles, Craig’s specific interests lie in technology that is designed to better our lives, including AI and ML, productivity aids, and smart fitness. He is also passionate about cars and the decarbonisation of personal transportation. As an avid bargain-hunter, you can be sure that any deal Craig finds is top value!