Heap buffer overflow in libXfont2 font server client glyph handling (CVE-2026-44950)

A heap buffer overflow exists in fs_read_glyphs() within the libXfont2 font-server client (src/fc/fserve.c). Per-glyph validation confirms each source slice lies within the source bitmap buffer but does not verify that cumulative destination writes remain within the allocated buffer, allowing a malicious font server to trigger writes far exceeding the allocation. When the X server runs as root this can lead to privilege escalation; when running as an unprivileged user it results in a denial of service (crash). Affected versions: - libXfont2 prior to 2.0.9 We recommend updating to: libXfont2-2.0.9. CVSS ? · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/436 Details: https://vuln.today/cve/CVE-2026-44950