libXfont2 CVE-2026-56001

Exploitation requires the attacker to already have the ability to connect to the target X Server as a client (AV:N/PR:L in the CVSS vector indicates authorized-but-low-privilege access, not anonymous access), and to trigger the vulnerable code path by requesting a scaled bitmap font that drives the 32-bit size calculation in BitmapScaleBitmaps to overflow. The concrete prerequisites are therefore: (1) X Server access - in default configurations this means local access, since modern X servers disable TCP listening, so remote exploitation is only possible where administrators have explicitly enabled remote X client connections; and (2) bitmap font handling must be reachable in the server's font path. Limiting factors that reduce real-world risk: no user interaction is needed once client access exists, but the requirement for X server client access, the low SSVC/EPSS exploitation signals, and the practical locality of X clients on current systems all constrain this well below internet-wide unauthenticated RCE.

Signals are mixed and should be weighed together rather than taken from the CVSS number alone. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H = 8.8) implies low-complexity, low-privilege exploitation with total impact, but the description constrains this to attackers 'able to access the X Server' - in most modern deployments X clients are local, so the real attack surface is a local or already-authorized user rather than an anonymous internet attacker, unless remote/TCP X client connections are explicitly enabled. This tension (network vector on paper versus practically local/authenticated access) should be verified against each deployment's X access configuration. SSVC rates Exploitation as none and Automatable as no, and EPSS is low (0.37%), so this is not currently a mass-exploited issue; however Technical Impact is total, matching the C:H/I:H/A:H claim of full code execution in the server context. Net assessment: a genuinely serious code-execution bug that warrants patching, but current real-world exploitation pressure is low and gated by X server access, making it a high-severity-but-moderate-urgency item rather than an emergency.

A local or otherwise authorized X client (for example a low-privileged user on a shared Linux workstation, or a compromised desktop application) requests a bitmap font scaled to a size that triggers the 32-bit size overflow in BitmapScaleBitmaps, undersizing a heap buffer. The subsequent out-of-bounds write corrupts X server heap memory and is groomed into control of execution, running attacker code in the X server process - often more privileged than the requesting client. No public proof-of-concept has been identified, so an attacker would need to develop the heap-grooming exploit themselves.