3

I've been searching and haven't been able to find anything on this.

There are lots of free fonts available online in .otf format. After downloading them, you Right click->Install to install the font on the system.

My question is whether there are any security risks when installing fonts in this manner. I don't know how the installation process works and viewing the file in a text editor shows it's not plain text, so I can't simply verify at a glance that it won't do anything bad.

Are .otf fonts safe to install on Windows?

Nate
  • 1,723

1 Answers1

4

The OpenType font format (the format used by OTF files) is actually just a container format (like MPEG is a container for many different video\audio formats). As such, it is itself safe. OTF files currently can contain either TrueType or Postscript fonts inside. I'd like to tell you that these are perfectly safe but, unfortunately, I can recall at least one time that Windows systems were at risk due to a security flaw in the TrueType font subsystem. This has been patched for over a decade now but it isn't impossible for something similar to happen again and, if it does, OpenType fonts will probably be just as vulnerable as TrueType or Postscript. I can say that, because these are not executable file formats, they are relatively safe. Clicking on (or installing) one of these files doesn't let the author take nearly complete control of your system (like an EXE with admin privs would) because both options will actually run another program and use the filename as a parameter to that program. Anyone who is going to use these against you is going to need to do so within the bounds of the Windows API routines which handle fonts. Of course, if they do figure out a way to use that against you then it'll probably be in a way that gives them much more control in the end.

krowe2
  • 726