PT-2026-28071 · Unknown · Fontconfig

CVE-2026-34085

·

Publicado

2026-03-25

·

Atualizado

2026-05-12

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions fontconfig versions prior to 2.17.1
Description fontconfig versions prior to 2.17.1 contain an off-by-one error in memory allocation during sfnt capability handling. This error can lead to a one-byte out-of-bounds write within the FcFontCapabilities function in fcfreetype.c, potentially resulting in a crash or code execution.
Recommendations Update fontconfig to version 2.17.1 or later.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-193

Identificadores relacionados

CVE-2026-34085
ECHO-4BBE-FCA4-ABF7
RHSA-2026:13722

Produtos afetados

Fontconfig