{"id":"CVE-2026-34085","aliases":["BELL-CVE-2026-34085","DEBIAN-CVE-2026-34085","EUVD-2026-15934","GHSA-jxv8-p782-98cx","JLSEC-2026-79","RHSA-2026:13722","UBUNTU-CVE-2026-34085"],"status":"published","title":"fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling,...","description":"fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00129,"percentile":0.02613,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-193"],"published":"2026-03-25T16:54:37Z","modified":"2026-10-28T10:49:33Z","fixes":[{"ecosystem":"Julia","package":"Fontconfig_jll","fixed_in":["2.17.1+0"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"fontconfig","fixed_in":["0:2.17.1-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"fontconfig-devel","fixed_in":["0:2.17.1-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"fontconfig-devel-doc","fixed_in":["0:2.17.1-0.1.hum1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Julia","package":"Fontconfig_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.17.1+0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"fontconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.1-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"fontconfig-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.1-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"fontconfig-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.1-0.1.hum1"}]}]}],"products":[{"vendor":"fontconfig","product":"fontconfig"},{"vendor":"fontconfig project","product":"fontconfig"},{"vendor":"fontconfig_project","product":"fontconfig"}],"references":[{"url":"https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/b9bec06d73340f1b5727302d13ac3df307b7febc","tags":["Patch","fix","web","article"]},{"url":"https://gitlab.freedesktop.org/fontconfig/fontconfig/-/merge_requests/446","tags":["Patch","fix","web","article"]},{"url":"https://gitlab.freedesktop.org/fontconfig/fontconfig/-/work_items/481","tags":["Issue Tracking","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34085","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jxv8-p782-98cx"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-34085","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34085.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34085","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13722","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34085","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13722.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451414","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34085","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2026-34085","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-34085","description":"fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.","status":"published","published":"2026-03-25T16:54:37.187Z","modified":"2026-04-02T17:50:01.562Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-15934","description":"fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.","status":"published","published":"2026-03-25T16:54:37Z","modified":"2026-04-02T17:50:01Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:25:22.606516Z"}],"ghsa":[{"id":"GHSA-jxv8-p782-98cx","title":"fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling,...","description":"fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.","status":"published","published":"2026-03-25T18:31:55Z","modified":"2026-03-25T18:32:08Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T15:06:50.631069Z"}],"nvd":[{"id":"CVE-2026-34085","description":"fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.","status":"published","published":"2026-03-25T17:17:09.21Z","modified":"2026-06-17T10:38:32.393Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:12:11.077116Z"}],"osv":[{"id":"BELL-CVE-2026-34085","title":"CVE-2026-34085 does not affect BellSoft software","status":"withdrawn","published":"2026-03-27T06:08:21.301951Z","modified":"2026-03-29T07:15:54.390515Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-34085","description":"fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.","status":"published","published":"2026-03-25T16:54:37.187Z","modified":"2026-10-28T10:49:33.144309286Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34085","description":"fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.","status":"withdrawn","published":"2026-03-25T17:17:09.21Z","modified":"2026-03-28T01:02:56.052847Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"JLSEC-2026-79","description":"fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.","status":"published","published":"2026-04-11T14:47:51.147Z","modified":"2026-07-18T00:02:23.374449678Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"RHSA-2026:13722","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-05-06T10:05:34Z","modified":"2026-10-06T10:31:12.223926685Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"UBUNTU-CVE-2026-34085","description":"(fontconfig before 2.17.1 has an off-by-one error in allocation during ...)","status":"withdrawn","published":"2026-03-26T00:00:00Z","modified":"2026-04-02T21:22:33.153173Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"}]}}