Fontconfig CVE-2026-34085

The CVSS 3.1 score of 5.9 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates a medium-severity local vulnerability requiring no privileges or user interaction, with low attack complexity and limited scope. The attack vector being Local (AV:L) reduces real-world risk for internet-facing services but elevates concern for multi-tenant systems, desktops, and container environments where local code execution is a realistic threat. The vulnerability's technical impact spans confidentiality, integrity, and availability (C:L/I:L/A:L), suggesting potential for information leakage, code execution, or denial of service. The off-by-one nature of the defect is highly reliable to trigger and exploit, as it does not depend on complex heap state alignment; a malicious font file reliably corrupts one byte in the heap. While KEV status and EPSS scores are not explicitly provided in the intelligence, the combination of a known patch (commit b9bec06d7334), proof-of-concept references available via merge request #446, local-only attack vector, and the deterministic nature of the buffer overflow suggest moderate-to-high exploitation probability among sophisticated attackers. However, the one-byte limitation and local-only vector mean widespread automatic exploitation across internet infrastructure is unlikely; real-world impact is highest in scenarios where untrusted fonts are processed by fontconfig-dependent applications (web browsers, document renderers, font managers).

An attacker crafts a malicious SFNT font file with capability structures that trigger the off-by-one allocation error in FcFontCapabilities. When a user opens this font file directly in a font manager, previews it in a document containing the embedded font, or loads it through a web browser's font-loading mechanism, fontconfig processes the font and writes one byte beyond the allocated buffer on the heap. This one-byte write corrupts adjacent heap metadata or data structures, enabling the attacker to either crash the application (denial of service) or, with careful heap grooming, corrupt pointers or function dispatch tables to achieve arbitrary code execution with the privileges of the user running the fontconfig-dependent application. Proof-of-concept details are referenced in the GitLab merge request #446, indicating the defect is well-understood and reproducible by security researchers.