CVE Explorer
CVE-2026-34085
fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"fontconfig","vendor":"fontconfig project","versions":[{"lessThan":"2.17.1","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:0af08ae3d07ca058cce1f029c735ca4ab0679ea07ddcd707136567a7224d2133 · sha256:adb982aac92159d8… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:0af08ae3d07ca058cce1f029c735ca4ab0679ea07ddcd707136567a7224d2133 · sha256:adb982aac92159d8… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-193","description":"CWE-193 Off-by-one Error","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:0af08ae3d07ca058cce1f029c735ca4ab0679ea07ddcd707136567a7224d2133 · sha256:adb982aac92159d8… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"url":"https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/b9bec06d73340f1b5727302d13ac3df307b7febc"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:0af08ae3d07ca058cce1f029c735ca4ab0679ea07ddcd707136567a7224d2133 · sha256:adb982aac92159d8… · /containers/cna/references/0
{"url":"https://gitlab.freedesktop.org/fontconfig/fontconfig/-/merge_requests/446"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:0af08ae3d07ca058cce1f029c735ca4ab0679ea07ddcd707136567a7224d2133 · sha256:adb982aac92159d8… · /containers/cna/references/1
{"url":"https://gitlab.freedesktop.org/fontconfig/fontconfig/-/work_items/481"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:0af08ae3d07ca058cce1f029c735ca4ab0679ea07ddcd707136567a7224d2133 · sha256:adb982aac92159d8… · /containers/cna/references/2
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.