CVE-2026-56002
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A heap buffer overflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows authenticated X clients to execute code within the X server.
Risk Assessment
An attacker with access to the X server can gain control over it, leading to privilege escalation and potential compromise of system confidentiality and integrity.
Recommendation
Immediately update libXfont2 to version 2.0.8 or later, which includes a fix for this vulnerability.
Other vulnerabilities in libXfont2
See all- CVE-2026-56003High
A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before version 2.0.8 allows authenticated X clients to execute code within the X server.
- CVE-2026-56001High
A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32-bit size could be used by attackers able to access the X Server to execute code within the X server context.
Original NVD description (English source)
A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.