Critical Security Update for mingw-fontconfig: Expat Memory Allocation Vulnerability
Summary
ALSA-2026:3407: Important: mingw-fontconfig security update. Affects mingw32-fontconfig versions < 2.12.6-4.el8_10. Fixed in 2.12.6-4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The mingw-fontconfig package is a MinGW Windows Fontconfig library that provides font configuration and customization capabilities for applications on Windows. It is widely used in various software projects to manage font access and rendering. However, this package has been found to have a significant vulnerability related to the Expat library, which can lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability stems from the Expat library used in mingw-fontconfig, which allows attackers to trigger large dynamic memory allocations through a small document submitted for parsing. This can lead to denial of service or potentially allow an attacker to execute arbitrary code, compromising the integrity and availability of the affected systems. The specific CVE associated with this issue is CVE-2025-59375.
How To Fix
Minimum fixed version
2.12.6-4.el8_10
This is the first release that contains the fix.
sudo dnf update mingw32-fontconfigTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the size of documents submitted for parsing to prevent triggering the vulnerability until the package can be updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The mingw-fontconfig package has a critical vulnerability related to the Expat library that can lead to severe security risks. It is crucial for users to update to the latest patched version to protect their applications from potential exploitation. Utilizing tools like Vulert can further enhance security monitoring and vulnerability management.
See every vulnerability recorded for mingw32-fontconfig →
FAQ
The vulnerability allows attackers to exploit the Expat library for large memory allocations, potentially leading to denial of service or arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the mingw-fontconfig package to version 2.12.6-4.el8_10 or later to ensure that the vulnerability is patched.
Updating the package should not cause data loss, but it is always recommended to back up your data before performing updates.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights into potential security issues.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
