CVE-2026-56003
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before version 2.0.8 allows authenticated X clients to execute code within the X server.
Risk Assessment
Attackers with authenticated access to the X server can exploit this vulnerability for remote code execution, leading to compromise of the X server and potentially the entire system.
Recommendation
Immediately update libXfont2 to version 2.0.8 or later. Restricting X server access to trusted clients can mitigate the risk.
Other vulnerabilities in libXfont2
See all- CVE-2026-56002High
A heap buffer overflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows authenticated X clients to execute code within the X server.
- CVE-2026-56001High
A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32-bit size could be used by attackers able to access the X Server to execute code within the X server context.
Original NVD description (English source)
A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.