CVE-2026-34085: 
NixOS vulnerability analysis and mitigation

CVE-2026-34085 is an off-by-one error in fontconfig's sfnt capability handling that leads to a one-byte out-of-bounds write, potentially causing a crash or arbitrary code execution. It affects fontconfig versions before 2.17.1, specifically in the FcFontCapabilities function in fcfreetype.c. The vulnerability was published on March 25, 2026, and a patch was made available shortly after. It carries a CVSS v3.1 base score of 7.8 (High) per Red Hat's assessment (Red Hat CVE, Red Hat Bugzilla).

The root cause is an off-by-one error (CWE-193) in memory allocation within the FcFontCapabilities function in fcfreetype.c, which handles sfnt (TrueType/OpenType) font capability data. The allocation is undersized by one byte, allowing a single byte to be written beyond the allocated buffer boundary — classified as an out-of-bounds write (CWE-787). An attacker with local access can trigger this condition by supplying a malicious font file that is processed by fontconfig, requiring only low privileges and no user interaction. The fix is available upstream via commit b9bec06d73340f1b5727302d13ac3df307b7febc and merge request 446 on the fontconfig GitLab repository (GitLab Commit, GitLab MR).

Successful exploitation can result in denial of service via application crash or, in more severe scenarios, arbitrary code execution in the context of the application processing the malicious font. Because fontconfig is a widely used library for font configuration and rendering on Linux and other Unix-like systems, a broad range of applications — including desktop environments, document viewers, and web browsers — could be affected. The vulnerability does not allow privilege escalation beyond the current user's scope, but code execution could enable lateral movement or data exfiltration within the local user's access boundary (Red Hat CVE, Red Hat Bugzilla).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported.

1. Reconnaissance: Identify a target system running fontconfig versions prior to 2.17.1 on Linux or another Unix-like OS where the attacker has local user access.
2. Craft malicious font file: Create or obtain a specially crafted sfnt (TrueType/OpenType) font file designed to trigger the off-by-one allocation error in FcFontCapabilities within fcfreetype.c.
3. Trigger font processing: Place the malicious font file in a location where it will be loaded by fontconfig — for example, in a user font directory (~/.local/share/fonts/) or by invoking an application (e.g., a document viewer, image renderer, or text editor) that processes the font.
4. Trigger out-of-bounds write: When fontconfig processes the sfnt capability data in the malicious font, the off-by-one error causes a one-byte write beyond the allocated buffer, corrupting adjacent heap memory.
5. Achieve objective: Depending on heap layout and application context, the memory corruption may cause a crash (denial of service) or, with further exploitation techniques, lead to arbitrary code execution within the application's process (GitLab Commit, Red Hat Bugzilla).

• File System: Unexpected or unfamiliar font files (.ttf, .otf) placed in user font directories such as ~/.local/share/fonts/ or system font directories; font files with malformed or oversized sfnt capability tables.
• Logs: Application crash logs or core dumps from processes that invoke fontconfig (e.g., Xorg, pango, cairo, document viewers); repeated segmentation fault entries in /var/log/syslog or journalctl output associated with font-loading operations.
• Process: Unexpected crashes or abnormal termination of GUI applications or font-rendering processes; processes spawning unexpected child processes after font loading events.

The primary remediation is to upgrade fontconfig to version 2.17.1 or later, which contains the fix for this off-by-one error. The patch is available upstream at the fontconfig GitLab repository (commit b9bec06d73340f1b5727302d13ac3df307b7febc) and via Red Hat's errata (RHSA-2026:13722). As a temporary workaround, restrict local user permissions to prevent untrusted users from supplying or loading arbitrary font files, and monitor systems for unexpected application crashes related to font processing (Red Hat Errata, GitLab MR).

Red Hat has acknowledged the vulnerability and issued a security advisory (RHSA-2026:13722) with a patch for affected Red Hat products (Red Hat Errata). The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers. No significant broader media coverage or notable researcher commentary has been identified at this time.