Description
fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| fontconfig project | fontconfig | < 2.17.1 | 2.17.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | fontconfig +2 | 2.17.1-0.1.hum1 | RHSA-2026:13722 |
Advisories 2
- RHSA-2026:13722 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- WID-SEC-2026-1365 Red Hat Hardened Images RPMs (fontconfig): Schwachstelle ermöglicht Codeausführung oder DoS BSI CERT-Bund (WID) · May 5, 2026