Fontconfig Project Fontconfig vulnerabilities
2 known vulnerabilities affecting fontconfig_project/fontconfig.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH2
Vulnerabilities
Page 1 of 1
CVE-2026-34085P3HIGHCVSS 7.8v2.17.0fixed in 2.17.12026-03-25
CVE-2026-34085 [HIGH] CWE-193 CVE-2026-34085: fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, lead
fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.
nvdosv
CVE-2016-5384P4HIGHCVSS 7.8fixed in 2.12.12016-08-13
CVE-2016-5384 [HIGH] CWE-415 CVE-2016-5384: fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary fr
fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.
nvdosv