CVE-2026-34085

Name	CVE-2026-34085
Description	fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
fontconfig (PTS)	bullseye	2.13.1-4.2	vulnerable
	bookworm	2.14.1-4	vulnerable
	trixie	2.15.0-2.3	vulnerable
	forky, sid	2.17.1-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
fontconfig	source	(unstable)	2.17.1-3

Notes

https://gitlab.freedesktop.org/fontconfig/fontconfig/-/work_items/481
Fixed by: https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/b9bec06d73340f1b5727302d13ac3df307b7febc (2.17.1)