Skip to main content

Libxfont CVE-2026-56002

| EUVDEUVD-2026-42211 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-07-08 GHSA-r49w-hq6h-2w8q
Buffer Overflow Heap Overflow Libxfont
8.8
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jul 13, 2026

Heap-based code execution in libXfont2 before 2.0.8 allows an authenticated X client to run arbitrary code inside the X server by supplying a malformed PCF font that trips missing glyph bounds checking in pcfReadFont(). Because X servers frequently run with elevated (often root) privileges, a successful exploit can escalate from a low-privileged client to full host compromise. No public exploit is identified at time of analysis and CISA SSVC rates current exploitation as none, but the technical impact is rated total.

Earlier versions of this analysis (4)
v4 Jul 13, 2026 - 14:13 cvss changed CVSS 8.8

Arbitrary code execution in the X.Org libXfont2 font library (all versions before 2.0.8) lets an authenticated X client compromise the X server by supplying a malicious PCF font that overflows the heap during pcfReadFont() parsing. Because code runs inside the X server - historically a high-privilege process - a successful attack yields high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis; SSVC records exploitation as none and the EPSS probability is low (0.53%, 41st percentile).

v3 Jul 08, 2026 - 10:28 cvss changed CVSS 8.5

Arbitrary code execution in the X.Org libXfont2 font library (versions before 2.0.8) allows an authenticated X client to corrupt heap memory inside the X server via a crafted PCF font. The flaw lives in pcfReadFont(), which fails to validate glyph bounds (CWE-122), and because the code runs in the X server context a successful attacker gains the server's privileges. No public exploit identified at time of analysis; the issue is not in CISA KEV, but the upstream fix is public on freedesktop GitLab, which lowers the bar to reproduce.

v2 Jul 08, 2026 - 10:28 cvss changed CVSS 8.5

Arbitrary code execution in the X server via libXfont2 before 2.0.8 allows an authenticated X client to trigger a heap buffer overflow in pcfReadFont() by supplying a malformed PCF bitmap font with out-of-bounds glyph metrics. Because the flawed parser runs inside the privileged X server, a compromised or malicious client can escalate into the server's context (CVSS 3.1 scope-changed, base 8.5). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

v1 Jul 08, 2026 - 02:22

Heap buffer overflow in libXfont2's pcfReadFont() function allows write-past-end with attacker-controlled content during PCF font parsing. Affected systems running any X.Org X server linked against libXfont2 prior to 2.0.8 are vulnerable whenever a malicious PCF font file can be introduced into a font path the server reads. No rendering step is required - the overflow is triggered during font parsing itself, making exploitation reliable once a crafted font is loaded. No public exploit or CISA KEV listing is present at time of analysis.

Affected VersionsENISA

libXfont2 0 <2.0.8

Affected Packages

euvd libxfont2 fix: 2.0.8

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Libxfont gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY HIGH
NVD 8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Attacker must be an authenticated X client feeding a crafted font (PR:L), the practical vector is the local X session rather than remote TCP (AV:L), and reliable heap exploitation needs grooming (AC:H); code runs in the high-value X server so C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.3 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Red Hat 7.3 HIGH

Primary rating from Vendor (CNA).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 13, 2026 - 14:13 vuln.today
v5 - CVSS changed
Analysis Updated
Jul 13, 2026 - 14:13 vuln.today
v4 - CVSS changed
CVSS changed
Jul 13, 2026 - 14:07 NVD
8.5 (HIGH) 8.8 (HIGH)
Patch available
Jul 08, 2026 - 11:01 EUVD
Analysis Updated
Jul 08, 2026 - 10:28 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 08, 2026 - 10:28 vuln.today
v2 - CVSS changed
CVSS changed
Jul 08, 2026 - 10:22 NVD
8.5 (HIGH)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Heap Buffer Overflow in GitLab via libXfont2 PCF Parsing - CVE-2026-56002 Jul 08, 2026

Zero Day Initiative Advisories

ZDI-26-407 X.Org Server PCF Font Parsing Heap-based Buffer Overflow Privilege Escalation Vulnerability Jul 2026

Executive ViewAI

Why It Matters

libXfont2 versions prior to 2.0.8 contain a critical remote code execution vulnerability allowing authenticated users to execute arbitrary code with X server privileges, typically root. While no public exploit currently exists, the vulnerability poses significant risk for organizations running X11 display servers due to its capability for complete host compromise through privilege escalation. This particularly impacts environments with X terminal servers, development systems, and any infrastructure where X servers operate with elevated privileges.

Recommended Action

Within 24 hours, inventory all systems running libXfont2 and determine current versions using package managers (e.g., 'rpm -q libXfont2' on Red Hat systems or 'dpkg -l | grep libxfont2' on Debian/Ubuntu). Within 7 days, develop and test patching procedures for libXfont2 2.0.8 or later across representative staging environments to validate application compatibility and identify any service dependencies. Within 30 days, deploy the patched version across all production systems, prioritizing systems running X servers with elevated privileges or in high-trust networks, and verify successful patching through automated inventory scanning.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.5%
Top 59% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

45
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Related Vulnerabilities in libXfont2 Security Flaws

View all 3
CVE-2026-56003 HIGH
8.8
CVE-2026-56001 HIGH
8.8

More in Libxfont

View all
CVE-2013-6462 CRITICAL POC
9.3 Jan 09

Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 al
CVE-2015-1804 HIGH
8.5 Mar 20

The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not proper
CVE-2015-1802 HIGH
8.5 Mar 20

The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote a
CVE-2015-1803 HIGH
8.5 Mar 20

The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not proper
CVE-2014-0211 HIGH
7.5 May 15

Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org

CVE-2014-0210 HIGH
7.5 May 15

Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execu
CVE-2017-13722 HIGH
7.1 Oct 11

In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary

CVE-2017-13720 HIGH
7.1 Oct 11

In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with acce
CVE-2017-16611 MEDIUM
5.5 Dec 01

In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as roo
CVE-2014-0209 MEDIUM
4.6 May 15

Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/kiosk/xorg:21.1-82.11 Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

References

Advisories & patches
ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/b4389e0b1d84a690b819bb27b1439968811a3674 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/be0b08e2d354138d3222b4490e2a77c6ee42f778 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/dff957a5158da038a282a59a31fe736702732939 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-56002 ADVISORY https://seclists.org/oss-sec/2026/q3/93 ADVISORY https://ubuntu.com/security/notices/USN-8560-1 ADVISORY https://vuldb.com/vuln/376822 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22614/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2793/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2794/ REF https://www.openwall.com/lists/oss-security/2026/07/08/1

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy