CVE-2026-34085

7.8 highEPSS 0.1%

High (7.8) in fontconfig project fontconfig. EPSS 0.1% chance of exploitation in the next 30 days.

fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-31)
CWE: CWE-193
Published: 2026-03-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fontconfig_project:fontconfig

References

https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/b9bec06d73340f1b5727302d13ac3df307b7febc
https://gitlab.freedesktop.org/fontconfig/fontconfig/-/merge_requests/446
https://gitlab.freedesktop.org/fontconfig/fontconfig/-/work_items/481

Check your stack JSON