PT-2026-28071 · Unknown · Fontconfig

Published 2026-03-25 · Updated 2026-05-12 · CVE-2026-34085

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions fontconfig versions prior to 2.17.1

Description fontconfig versions prior to 2.17.1 contain an off-by-one error in memory allocation during sfnt capability handling. This error can lead to a one-byte out-of-bounds write within the FcFontCapabilities function in fcfreetype.c, potentially resulting in a crash or code execution.

Recommendations Update fontconfig to version 2.17.1 or later.

Fix

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2026-34085

ECHO-4BBE-FCA4-ABF7

RHSA-2026:13722

Affected Products

Fontconfig

References · 14

• https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/b9bec06d73340f1b5727302d13ac3df307b7febc · Patch
• https://ubuntu.com/security/CVE-2026-34085 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34085 · Vendor Advisory
• https://gitlab.freedesktop.org/fontconfig/fontconfig/-/merge_requests/446 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34085 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34085 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-34085 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-34085 · Vendor Advisory
• https://t.me/cveNotify/163242 · Telegram Post
• https://gitlab.freedesktop.org/fontconfig/fontconfig/-/work_items/481 · Note
• https://twitter.com/TheRabbitPy/status/2038299294738882816 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2036910347869647111 · Twitter Post
• https://twitter.com/TheRabbitPy/status/2038299047224565991 · Twitter Post
• https://twitter.com/CVEnew/status/2036911832724890007 · Twitter Post