Fontconfig Project vulnerabilities
We track 1 vulnerability in Fontconfig Project products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on March 25, 2026.
1vulnerabilities
0critical
1high
0exploited
7.8average CVSS score
Latest Fontconfig Project vulnerabilities
- 7.8 High severity
fontconfig: Off-by-one Error
fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.