Fontconfig versions prior to 2.17.1 contain an off‑by‑one error in the allocation of sfnt capabilities within FcFontCapabilities in fcfreetype.c. This flaw results in a one‑byte out‑of‑bounds write that can overwrite adjacent memory, potentially leading to a crash or, if exploited in a particular way, arbitrary code execution. The vulnerability is a classic bounds‑check error (CWE‑193).

Any system running fontconfig 2.16.x or earlier is susceptible. The affected vendor is the Fontconfig Project and all products that ship the library without an official patch are at risk. The specific affected version information is not listed beyond the pre‑2.17.1 range.

CVSS score of 5.9 and an EPSS score of less than 1% indicate moderate severity yet a low likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalogue, suggesting no widespread public attacks have been observed. The most likely attack path involves an attacker supplying a crafted font file to an application that reads fonts via fontconfig, triggering the off‑by‑one write during sfnt capability handling and potentially causing a crash or arbitrary code execution. All exploit conditions remain theoretical pending public evidence.