FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c.
{ "urgency": "not yet assigned" }