← Back

Fontconfig

fontconfig

Vendor: Fontconfig Project • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-34085
1Fontconfig Project
1Fontconfig
Jun 17, 2026
Mar 25, 2026
N/A· v4
7.8 HIGH· v3
N/A· v2
fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfre...Show more
fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.Show less
CVE-2016-5384
4Canonical
DebianFedoraproject+1 more
4Debian Linux
FedoraFontconfig+1 more
May 6, 2026
Aug 13, 2016
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.