What is the CVSS score of CVE-2026-44950?

CVE-2026-44950 has a CVSS 4.0 base score of 9.5 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-44950?

Within 24 hours, inventory all systems running X server and identify which instances operate with root privileges and maintain font server connections; simultaneously disable or restrict font server access where operationally feasible. Within 7 days, implement network-level controls limiting X server connections to trusted, internal font servers only and audit font server configurations for signs of compromise. Within 30 days, monitor Xfont2 project advisories for version 2.0.9 availability, conduct formal testing in a controlled environment, and execute a phased deployment prioritizing systems running X server with root privileges.

libXfont2 CVE-2026-44950

EUVD-2026-75306 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-08-05

GHSA-72vv-3gwg-8289

Buffer Overflow Heap Overflow

9.5

CVSS 4.0 · Vendor

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Control or intercept FS protocol font server
Delivery

Await X server font request connection
Exploit

Send FS_QueryXBitmaps16 with nbytes=64 and 1000 overlapping glyph offsets
Execution

Per-glyph source validation passes; cumulative destination unchecked
Persist

64,000-byte heap overflow into 64-byte allbits buffer
Impact

Heap metadata corruption enables privilege escalation to root (or crash if X is unprivileged)

Vulnerability Assessment

Weakness	CWE CWE-122 ASVS 5.0 V15 - Secure Coding and Architecture Heap buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires three specific conditions to align: (1) the target X server must be configured with a `FontPath` directive referencing a font server using the legacy FS protocol (e.g., `unix/:7100` or `fs://hostname:7100`), which is non-default on modern distributions; (2) the attacker must control the font server endpoint or intercept the FS protocol connection (via MitM, DNS poisoning, or compromise of the font server host); (3) the X server must process a font request that triggers `fs_read_glyphs()`. Privilege escalation specifically requires the X server process to run as root - a legacy deployment pattern. On systems where X runs as an unprivileged user, exploitation is limited to crashing the X session. Systems using Wayland or local PCF/BDF fonts only (without FS protocol font servers) are not exposed regardless of libXfont2 version.
Impact	Real-world risk is elevated by the attacker-controlled content and size of the heap overflow, which creates strong primitives for exploitation. However, several factors constrain the attack surface: the X server must be configured to use a legacy Font Server via the FS protocol - a non-default configuration that is increasingly absent on modern Linux deployments. Exploitation requires the attacker to control or intercept the font server connection, adding meaningful complexity. CVSS vector is not provided by NVD at time of analysis; independent assessment places this at AV:N/AC:H given the font server requirement. No EPSS score or KEV listing is available, so exploitation probability is unconfirmed. The privilege escalation path applies specifically to environments where the X server runs as root - a legacy configuration still present in some embedded systems and older enterprise desktops. On modern rootless X or Wayland-forwarded setups, the impact degrades to a crash. SSVC signals: exploitation status unknown, automatable once font server is controlled, technical impact is total if root X server is targeted.
Exploit ScenarioDerived	An attacker who can operate or intercept a font server (e.g., via ARP spoofing on the local network, BGP hijack of a remote FS server, or DNS poisoning) waits for an X server configured with `FontPath fs://attacker-host:7100` to connect. The attacker's server responds to `FS_QueryXBitmaps16` with `nbytes=64` but includes 1000 glyph entries all pointing to `{position:0, length:64}`, causing 64,000 bytes of attacker-controlled data to overflow the 64-byte `allbits` heap buffer in the X server process. If the X server runs as root, the attacker leverages heap metadata corruption for privilege escalation to root. No public proof-of-concept exploit has been identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 05, 2026

Heap buffer overflow in libXfont2's font-server client allows a malicious or compromised font server to overflow the X server's heap with attacker-controlled content by sending overlapping glyph source offsets. Affected systems running X server as root are exposed to privilege escalation; unprivileged X server instances crash with denial of service. All libXfont2 versions prior to 2.0.9 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attacker-controlled write primitive makes this a high-severity memory corruption issue.

RemediationAI

Upgrade libXfont2 to version 2.0.9 or later, available from the X.Org upstream repository. The specific fix commit for CVE-2026-44950 is at https://gitlab.freedesktop.org/xorg/lib/libXfont/-/commit/2de3cf305c3c9e95410f05fbada967989bcc95af, which adds a cumulative destination bounds check before each memcpy in fs_read_glyphs(). Linux distribution maintainers should apply this upstream patch and release updated packages. As a compensating control, disable font server client functionality by removing any FontPath entries referencing fs:// or unix/:7100-style font servers from Xorg configuration files (/etc/X11/xorg.conf or /etc/X11/xorg.conf.d/); this eliminates the attack vector entirely but prevents use of legacy network font servers. Additionally, restrict X server startup to non-root users where operationally feasible to limit the privilege escalation path to a denial-of-service impact only. Advisory: https://seclists.org/oss-sec/2026/q3/436.

Affected VersionsENISA

SUSE Linux Enterprise Server 15 SP7 ? <2.0.3-150000.3.6.1

SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAP-Hardened-BYOS-EC2 ? <2.0.3-150000.3.6.1

Image SLES-SAP-GCE-3P ? <2.0.7-160000.5.1

SUSE Liberty Linux 10 ? <2.0.6-5.el10_2.3

Image SLES15-SP6-SAP-Hardened-EC2 ? <2.0.3-150000.3.6.1

SUSE Linux Enterprise Desktop 15 SP7 ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAP-Hardened-BYOS-GCE ? <2.0.3-150000.3.6.1

SUSE Manager Retail Branch Server LTS 4.3 ? <2.0.3-150000.3.6.1

libXfont ? ≤2.0.8

Image SLES12-SP5-EC2-SAP-BYOS ? <2.0.3-3.6.1

Image SLES-SAP-GCE ? <2.0.7-160000.5.1

SUSE Linux Enterprise Server for SAP Applications 15 SP7 ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAP-Hardened-Azure ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAP-Azure ? <2.0.3-150000.3.6.1

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAP-Hardened ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAP-Hardened-BYOS-EC2 ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAPCAL-Azure ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAP-GCE-3P ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAPCAL-GCE ? <2.0.3-150000.3.6.1

SUSE Linux Enterprise Server 15 SP4-LTSS ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAP-EC2 ? <2.0.3-150000.3.6.1

SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS ? <2.0.3-150000.3.6.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS ? <2.0.3-150000.3.6.1

SUSE Liberty Linux 8 ? <2.0.3-2.el8_10.3

Image SLES15-SP7-SAP-Hardened-Azure ? <2.0.3-150000.3.6.1

SUSE Linux Enterprise Module for Basesystem 15 SP7 ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAP-Azure-3P ? <2.0.3-150000.3.6.1

Image SLES12-SP5-Azure-SAP-BYOS ? <2.0.3-3.6.1

SUSE Linux Enterprise Server 16.0 ? <2.0.7-160000.5.1

Container suse/kiosk/tigervnc-x11vnc:1.14-63.8 ? <2.0.3-150000.3.6.1

SUSE Linux Enterprise Server 15 SP5-LTSS ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAP-Azure ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAP-GCE ? <2.0.3-150000.3.6.1

openSUSE Leap 16.0 ? <2.0.7-160000.5.1

Image SLES-SAP-Azure-3P ? <2.0.7-160000.5.1

openSUSE Tumbleweed ? <2.0.7-3.1

Image SLES15-SP7-SAP-Hardened-GCE ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAPCAL-EC2 ? <2.0.3-150000.3.6.1

SUSE Manager Proxy LTS 4.3 ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAP-BYOS-Azure ? <2.0.3-150000.3.6.1

Image SLES-SAP-Azure ? <2.0.7-160000.5.1

Image SLES12-SP5-EC2-SAP-On-Demand ? <2.0.3-3.6.1

Image SLES15-SP6-SAP ? <2.0.3-150000.3.6.1

SUSE Linux Enterprise Server for SAP Applications 15 SP5 ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAP-Azure-3P ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAPCAL-GCE ? <2.0.3-150000.3.6.1

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 ? <2.0.3-3.6.1

Image SLES15-SP6-SAP-Hardened-BYOS-GCE ? <2.0.3-150000.3.6.1

Image SLES-SAP-BYOS-GCE ? <2.0.7-160000.5.1

Image SLES-SAPCAL-GCE ? <2.0.7-160000.5.1

Image SLES12-SP5-GCE-SAP-On-Demand ? <2.0.3-3.6.1

Image SLES15-SP6-SAP-BYOS-Azure ? <2.0.3-150000.3.6.1

SUSE Linux Enterprise Server for SAP Applications 15 SP6 ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAPCAL ? <2.0.3-150000.3.6.1

Image SLES-SAP-BYOS-Azure ? <2.0.7-160000.5.1

Image SLES12-SP5-Azure-SAP-On-Demand ? <2.0.3-3.6.1

SUSE Linux Enterprise Server 12 SP5-LTSS ? <2.0.3-3.6.1

Image SLES15-SP6-SAP-Hardened-BYOS-Azure ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAP-BYOS-GCE ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAP-BYOS ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAP-Hardened-BYOS ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAP-BYOS-EC2 ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAP-Hardened-GCE ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAP-EC2 ? <2.0.3-150000.3.6.1

Image SLES12-SP5-GCE-SAP-BYOS ? <2.0.3-3.6.1

SUSE Linux Enterprise Server for SAP Applications 15 SP4 ? <2.0.3-150000.3.6.1

SUSE Manager Server LTS 4.3 ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAP-BYOS-EC2 ? <2.0.3-150000.3.6.1

SUSE Liberty Linux 9 ? <2.0.3-12.el9_8.3

SUSE Linux Enterprise Server for SAP applications 16.0 ? <2.0.7-160000.5.1

Image SLES15-SP7-SAPCAL-Azure ? <2.0.3-150000.3.6.1

Image SLES-SAP-BYOS-EC2 ? <2.0.7-160000.5.1

Container suse/kiosk/xorg:21.1-83.7 ? <2.0.3-150000.3.6.1

Image SLES15-SP7-SAP-Hardened-BYOS-Azure ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAP-GCE ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAP-BYOS-GCE ? <2.0.3-150000.3.6.1

SUSE Linux Enterprise Server 15 SP6-LTSS ? <2.0.3-150000.3.6.1

Image SLES15-SP6-SAPCAL-EC2 ? <2.0.3-150000.3.6.1

Affected Packages

euvd container_suse_kiosk_tigervnc_x11vnc_1_14_63_8 fix: 2.0.3-150000.3.6.1

euvd container_suse_kiosk_xorg_21_1_83_7 fix: 2.0.3-150000.3.6.1

euvd image_sles12_sp5_azure_sap_byos fix: 2.0.3-3.6.1

euvd image_sles12_sp5_azure_sap_on_demand fix: 2.0.3-3.6.1

euvd image_sles12_sp5_ec2_sap_byos fix: 2.0.3-3.6.1

euvd image_sles12_sp5_ec2_sap_on_demand fix: 2.0.3-3.6.1

euvd image_sles12_sp5_gce_sap_byos fix: 2.0.3-3.6.1

euvd image_sles12_sp5_gce_sap_on_demand fix: 2.0.3-3.6.1

euvd image_sles15_sp6_sap fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_azure fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_azure_3p fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_byos fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_byos_azure fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_byos_ec2 fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_byos_gce fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_ec2 fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_gce fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_hardened fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_hardened_azure fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_hardened_byos fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_hardened_byos_azure fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_hardened_byos_ec2 fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_hardened_byos_gce fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_hardened_ec2 fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sap_hardened_gce fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sapcal fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sapcal_azure fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sapcal_ec2 fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp6_sapcal_gce fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_azure fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_azure_3p fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_byos_azure fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_byos_ec2 fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_byos_gce fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_ec2 fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_gce fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_gce_3p fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_hardened_azure fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_hardened_byos_azure fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_hardened_byos_ec2 fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_hardened_byos_gce fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sap_hardened_gce fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sapcal_azure fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sapcal_ec2 fix: 2.0.3-150000.3.6.1

euvd image_sles15_sp7_sapcal_gce fix: 2.0.3-150000.3.6.1

euvd image_sles_sap_azure fix: 2.0.7-160000.5.1

euvd image_sles_sap_azure_3p fix: 2.0.7-160000.5.1

euvd image_sles_sap_byos_azure fix: 2.0.7-160000.5.1

euvd image_sles_sap_byos_ec2 fix: 2.0.7-160000.5.1

euvd image_sles_sap_byos_gce fix: 2.0.7-160000.5.1

euvd image_sles_sap_gce fix: 2.0.7-160000.5.1

euvd image_sles_sap_gce_3p fix: 2.0.7-160000.5.1

euvd image_sles_sapcal_gce fix: 2.0.7-160000.5.1

euvd libxfont no fix

euvd opensuse_leap_16_0 fix: 2.0.7-160000.5.1

euvd opensuse_tumbleweed fix: 2.0.7-3.1

euvd suse_liberty_linux_10 fix: 2.0.6-5.el10_2.3

euvd suse_liberty_linux_8 fix: 2.0.3-2.el8_10.3

euvd suse_liberty_linux_9 fix: 2.0.3-12.el9_8.3

euvd suse_linux_enterprise_desktop_15_sp7 fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_high_performance_computing_15_sp4_espos fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_high_performance_computing_15_sp4_ltss fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_high_performance_computing_15_sp5_espos fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_high_performance_computing_15_sp5_ltss fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_module_for_basesystem_15_sp7 fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_server_12_sp5_ltss fix: 2.0.3-3.6.1

euvd suse_linux_enterprise_server_15_sp4_ltss fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_server_15_sp5_ltss fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_server_15_sp6_ltss fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_server_15_sp7 fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_server_16_0 fix: 2.0.7-160000.5.1

euvd suse_linux_enterprise_server_for_sap_applications_15_sp4 fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_server_for_sap_applications_15_sp5 fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_server_for_sap_applications_15_sp6 fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_server_for_sap_applications_15_sp7 fix: 2.0.3-150000.3.6.1

euvd suse_linux_enterprise_server_for_sap_applications_16_0 fix: 2.0.7-160000.5.1

euvd suse_linux_enterprise_server_ltss_extended_security_12_sp5 fix: 2.0.3-3.6.1

euvd suse_manager_proxy_lts_4_3 fix: 2.0.3-150000.3.6.1

euvd suse_manager_retail_branch_server_lts_4_3 fix: 2.0.3-150000.3.6.1

euvd suse_manager_server_lts_4_3 fix: 2.0.3-150000.3.6.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 80 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

libXfont2 is the X.Org font library used by X servers to handle font rendering, including legacy Font Server (FS) protocol communication. The vulnerable function fs_read_glyphs() in src/fc/fserve.c allocates an allbits buffer of rep->nbytes bytes to hold concatenated glyph bitmap data. It iterates over each glyph and validates that each glyph's source slice (local_off.position + local_off.length) lies within the source bitmap buffer - a per-source check. However, it never validates that the cumulative number of bytes written to allbits stays within the rep->nbytes allocation. A malicious FS server can advertise nbytes=64 but return 1000 glyphs each with {position:0, length:64}, causing 64,000 bytes to be written into a 64-byte heap allocation via memcpy. This is a classic cumulative-vs-per-element bounds check failure (CWE-122, Heap-based Buffer Overflow) and is attributed to an incomplete fix of the prior CVE-2014-0210 vulnerability in the same function. The fix in libXfont2-2.0.9 adds a cumulative destination pointer check (if (local_off.length > rep->nbytes - (allbits - origallbits))) before each memcpy.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 9.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

vuln.today AI 9.0 CRITICAL

Network-adjacent font server required (AV:N/AC:H); no target-side privileges needed; scope changes to full system compromise when X runs as root.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE 9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat 7.5 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Heap Buffer Overflow in GitLab via libXfont2 Font Server - CVE-2026-44950 Aug 05, 2026

Executive ViewAI

Why It Matters

A critical heap buffer overflow in libXfont2 affects X servers across Linux systems, particularly those running with root privileges-a common configuration in enterprise environments. Attackers exploiting this vulnerability through a compromised or malicious font server could escalate privileges to root access, enabling full system compromise. With no vendor patch currently available and the defect affecting all versions prior to 2.0.9, organizations must immediately inventory and remediate X server deployments.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restricting network access to font servers through firewall rules and network segmentation, (2) running X server with unprivileged user accounts where architecturally feasible, (3) disabling font server functionality if operationally acceptable, and (4) monitoring font server processes for anomalous behavior indicating exploitation attempts.

Threat Intelligence Overview

EPSS Score

0.4%

Top 63% exploitable

Prevalence

Medium

core X.Org font library in Linux desktop environments

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +48

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Same weakness CWE-122 – Heap-based Buffer Overflow

View all

CVE-2023-4911 HIGH POC

7.8

CVE-2023-27997 CRITICAL

9.8

CVE-2026-94127 CRITICAL POC

9.3

CVE-2025-25249 CRITICAL POC

9.8

CVE-2026-85880 HIGH POC

7.8

CVE-2025-24985 HIGH POC

7.8

CVE-2026-53362 HIGH POC

7.8

CVE-2025-21418 HIGH

7.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

Debian

libxfont

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	1:2.0.4-1	-
bullseye (security)	vulnerable	1:2.0.4-1+deb11u1	-
bookworm, trixie	vulnerable	1:2.0.6-1	-
bookworm (security)	vulnerable	1:2.0.6-1+deb12u1	-
trixie (security)	vulnerable	1:2.0.6-1+deb13u1	-
forky, sid	vulnerable	1:2.0.8-1	-
(unstable)	fixed	(unfixed)	unimportant

SUSE

Severity: Critical

Product	Status
Container suse/kiosk/tigervnc-x11vnc:1.14-63.8 Container suse/kiosk/xorg:21.1-83.7 Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-Azure-3P Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-Azure Image SLES15-SP6-SAP-BYOS-EC2 Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-Hardened Image SLES15-SP6-SAP-Hardened-Azure Image SLES15-SP6-SAP-Hardened-BYOS Image SLES15-SP6-SAP-Hardened-BYOS-Azure Image SLES15-SP6-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-EC2 Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Fixed

References

Advisories & patches

ADVISORY https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44950 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libXfont/-/commit/2de3cf305c3c9e95410f05fbada967989bcc95af ADVISORY https://gitlab.freedesktop.org/xorg/lib/libXfont/-/commit/c5cdb67eba7c35789e034f18e22b269d08170197 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-44950 ADVISORY https://seclists.org/oss-sec/2026/q3/436 ADVISORY https://vuldb.com/vuln/391517 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3499/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3500/

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back