CVE-2026-34085 is an off-by-one error in fontconfig's handling of font capabilities that results in a one-byte out-of-bounds write. This memory handling flaw can cause applications that process fonts, such as fc-cache, to crash when encountering specially crafted fonts. The vulnerability requires local user interaction to trigger and primarily results in denial of service due to application crashes. While theoretically it could enable unauthorized code execution, the limited memory overwrite significantly restricts exploitation potential. Red Hat rates this vulnerability as moderate severity and has issued updated fontconfig RPMs in Red Hat Hardened Images to fix the issue.

The vulnerability can cause denial of service by crashing fontconfig-related applications, potentially disrupting graphical login services or other font-dependent applications. The one-byte memory overwrite limits the risk of arbitrary code execution or full system compromise. Exploitation requires local user interaction to install or process a malicious font file. There is no evidence of reliable exploitation for privilege escalation or data access.

Red Hat has released updated fontconfig RPM packages (fontconfig-2.17.1-0.1.hum1 and related) for Red Hat Hardened Images to address this vulnerability. Applying these official updates is the recommended remediation. Red Hat is not aware of any practical temporary workarounds that fully mitigate this issue. Users should follow Red Hat's update instructions at https://images.redhat.com/ and consult the advisory at https://access.redhat.com/errata/RHSA-2026:13722 for details.