Executive brief
fontconfig is a standard library used across Linux and Unix-like systems to discover and configure fonts. A flaw in how it handles specific font capabilities can cause the software to crash or potentially allow an attacker to execute unauthorized code. This typically occurs when the system processes a specially crafted font file, such as during a font cache update.
Technical details
An off-by-one error exists in the `FcFontCapabilities` function within `src/fcfreetype.c` of fontconfig. The vulnerability is rooted in an incorrect memory allocation size calculation during the handling of sfnt (Scalable Font Add-on) capabilities, specifically when calculating `maxsize` for the `complex_` buffer. When processing certain fonts (such as SIL Graphite fonts), the allocation fails to account for the null terminator or specific layout lengths correctly, leading to a one-byte out-of-bounds write. This can be triggered locally by tools like `fc-cache` when scanning malicious font files, potentially leading to a denial of service (crash) or arbitrary code execution. The issue is resolved in version 2.17.1.
Affected products
- fontconfig project fontconfig before 2.17.1
Timeline
- 2025-06-30: patched: Fix committed to upstream repository
- 2026-03-25: advisory: CVE published