fontconfig project vulnerabilities and threats

CVE-2026-34085 is an off-by-one error vulnerability in the fontconfig library before version 2.17.1. The flaw occurs in the allocation logic during sfnt capability handling within the FcFontCapabilities function in fcfreetype.c, causing a one-byte out-of-bounds write. This vulnerability can lead to a crash or potentially allow code execution. The CVSS score is 5.9, indicating a medium severity level. No patch or official fix information is provided in the available data. There are no known exploits in the wild at this time.