CVE-2026-59679
CriticalCVSS 9.0Summary
In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), the per-character encoding[] array is indexed using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) followed by a large num_chars (e.g. 100000), causing attacker-controlled out-of-bounds heap reads and writes.
Risk Assessment
A malicious font server can trigger out-of-bounds heap reads and writes, potentially leading to data leakage or code execution in the client process context. The risk affects systems using libXfont2 to communicate with font servers.
Recommendation
Update libXfont2 to a version containing the fix. Limit trust in remote font servers and use only trusted font sources.
Other vulnerabilities in libXfont2
See all- CVE-2026-44950Critical
In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), each glyph's bitmap is copied into a single buffer, and existing checks only validate that the source slice (position, length) lies within the source bitmap buffer. They do not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64), resulting in 64000 bytes written into a 64-byte destination buffer — a heap buffer overflow with attacker-controlled content.
- CVE-2026-56003High
A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before version 2.0.8 allows authenticated X clients to execute code within the X server.
- CVE-2026-56002High
A heap buffer overflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows authenticated X clients to execute code within the X server.
- CVE-2026-56001High
A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32-bit size could be used by attackers able to access the X Server to execute code within the X server context.
Original NVD description (English source)
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.