Skip to main content

libXfont2 CVE-2026-56001

| EUVDEUVD-2026-42210 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-07-08 GHSA-j726-7g32-78m6
Buffer Overflow Heap Overflow Red Hat Suse Libxfont
8.8
CVSS 3.1 · NVD
Share

Severity by source

Vendor (CNA) PRIMARY
HIGH
qualitative
NVD
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

X Server client access is normally local and authorized, so AV:L/PR:L; low-complexity trigger via font scaling yields AC:L and full code execution gives C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.3 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

9
Analysis Updated
Jul 09, 2026 - 20:02 vuln.today
v5 (cvss_changed)
Analysis Updated
Jul 09, 2026 - 20:01 vuln.today
v4 (cvss_changed)
CVSS changed
Jul 09, 2026 - 19:52 NVD
8.5 (HIGH) 8.8 (HIGH)
Patch available
Jul 08, 2026 - 10:01 EUVD
Analysis Updated
Jul 08, 2026 - 09:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 08, 2026 - 09:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 08, 2026 - 09:22 vuln.today
cvss_changed
CVSS changed
Jul 08, 2026 - 09:22 NVD
8.5 (HIGH)
Analysis Generated
Jul 08, 2026 - 02:24 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Arbitrary code execution in the X.Org libXfont2 library (versions before 2.0.8) stems from a heap buffer overflow in the BitmapScaleBitmaps routine, where a 32-bit size calculation overflows during bitmap font scaling. Any client able to connect to the X Server and request scaled bitmap fonts can corrupt heap memory and run code within the X server's process context, which is frequently privileged. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.37% (29th percentile), consistent with the SSVC finding of no observed exploitation despite total technical impact.

Technical ContextAI

libXfont2 is the second-generation X.Org font-handling library used by the X Server to load, rasterize, and scale legacy bitmap (BDF/PCF) fonts. The flaw is a CWE-122 heap-based buffer overflow in BitmapScaleBitmaps, the function that scales bitmap glyphs to a requested size. During size computation the code uses a 32-bit integer that can overflow, causing an undersized heap allocation followed by an out-of-bounds write when glyph bitmap data is copied. The CPE cpe:2.3:a:x:libxfont:* confirms the affected component is the libxfont application/library rather than the X server core itself, but because the library executes inside the X server address space, memory corruption there is corruption of the server. The upstream fix spans three commits on freedesktop.org GitLab that correct the size arithmetic to prevent the overflow.

RemediationAI

Upgrade libXfont2 to version 2.0.8 or later, which contains the corrected size arithmetic - Vendor-released patch: 2.0.8. On managed distributions, apply the vendor's updated libXfont2 package as soon as it is published and restart the X Server (or affected sessions) so the patched library is loaded. The fix is delivered via three upstream commits on freedesktop.org GitLab (be0b08e2, dff957a5, b4389e0b) referenced in the advisory. Where patching must be deferred, reduce exposure by preventing untrusted access to the X Server: disable remote/TCP X client connections (start the server with '-nolisten tcp', which is already the default on most modern systems) so only local authorized users can connect, and restrict which users may run X clients on shared or multi-user hosts. As a more targeted control, avoid or disable the use of scalable bitmap fonts / bitmap font scaling in the X font path where feasible, since the vulnerable code path is only reached when bitmap fonts are scaled; the trade-off is that legacy applications relying on scaled bitmap fonts may render incorrectly or fail to load fonts.

More in Libxfont

View all
CVE-2013-6462 CRITICAL POC
9.3 Jan 09

Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 al
CVE-2015-1804 HIGH
8.5 Mar 20

The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not proper
CVE-2026-56003 HIGH
8.8 Jul 08

Arbitrary code execution in libXfont2 before 2.0.8 lets an authenticated X client corrupt heap memory inside the X serve
CVE-2026-56002 HIGH
8.8 Jul 08

Heap-based code execution in libXfont2 before 2.0.8 allows an authenticated X client to run arbitrary code inside the X

CVE-2015-1802 HIGH
8.5 Mar 20

The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote a
CVE-2015-1803 HIGH
8.5 Mar 20

The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not proper
CVE-2014-0211 HIGH
7.5 May 15

Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org

CVE-2014-0210 HIGH
7.5 May 15

Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execu
CVE-2017-13722 HIGH
7.1 Oct 11

In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary

CVE-2017-13720 HIGH
7.1 Oct 11

In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with acce
CVE-2017-16611 MEDIUM
5.5 Dec 01

In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as roo
CVE-2014-0209 MEDIUM
4.6 May 15

Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/kiosk/xorg:21.1-82.11 Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

Share

CVE-2026-56001 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy