Skip to main content

libXfont2 CVE-2026-56003

| EUVDEUVD-2026-42212 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-07-08 GHSA-3v92-8994-jg8p
Buffer Overflow Heap Overflow Libxfont
8.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate as X client
  2. Delivery
    Supply crafted PCF font
  3. Exploit
    Overflow property buffer in ComputeScaledProperties
  4. Execution
    Corrupt X server heap
  5. Impact
    Execute code as X server (root)

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The attacker must be an authenticated X client (PR:L) able to submit or reference a crafted PCF bitmap font that the vulnerable X server parses via libXfont2's ComputeScaledProperties() - i.e., the legacy PCF/bitmap font-loading path must be reachable and enabled. No user interaction is needed (UI:N). Exploitation is limited by the need for an existing authenticated connection to the X server and by the fact that most current deployments only accept local X clients; systems that have migrated to Wayland or that disable bitmap/PCF font paths are not exposed, and SSVC marks the attack as not automatable, so mass exploitation is unlikely.
Impact

Signals are mixed and point to serious-but-not-emergency priority. CVSS 3.1 is 8.8 (High) with AV:N/AC:L/PR:L/UI:N and full C/I/A impact, and SSVC rates Technical Impact as 'total', reflecting code execution in a high-privilege process. Counterbalancing this: SSVC Exploitation is 'none', SSVC Automatable is 'no' (heap grooming/font delivery is not trivially scriptable at scale), EPSS is only 0.58% (44th percentile), there is no KEV listing and no public PoC. Note a scope caveat: the CVSS vector says AV:N, but exploitation requires the attacker to already be an authenticated X client feeding a font to the server - in most modern deployments X clients are local, so the practical attack surface is narrower than a raw 'network' reading implies; verify your X server's client access policy. Net: patch on a normal cycle, prioritize multi-user or network-accessible X hosts.
Exploit ScenarioDerived

An authenticated but low-privilege user on a shared Linux workstation connects as an X client and requests loading of a specially crafted PCF font whose property table exceeds the allocated buffer. When ComputeScaledProperties() processes it, the heap overflow corrupts X server memory, letting the attacker escalate to the X server's privileges (often root). No public PoC is currently known, and the attack requires deliberate crafting of the font rather than an automatable mass technique.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jul 09, 2026

Arbitrary code execution in libXfont2 before 2.0.8 lets an authenticated X client corrupt heap memory inside the X server via a maliciously crafted PCF bitmap font. The flaw sits in ComputeScaledProperties(), where a missing bounds check on the property buffer allows a heap overflow (CWE-122) that runs in the X server's security context - typically root on traditional Linux desktops. There is no public exploit identified at time of analysis; EPSS is modest at 0.58% and CISA SSVC rates exploitation as 'none' with 'total' technical impact.

Earlier versions of this analysis (4)
v4 Jul 09, 2026 - 19:59 cvss changed CVSS 8.8

Heap-based buffer overflow in libXfont2's PCF font parser (ComputeScaledProperties) lets an authenticated X client execute arbitrary code inside the X server process on versions before 2.0.8. Because the X server historically runs with elevated privileges, code execution in that context can lead to full local compromise. This is a real memory-corruption flaw (CWE-122) fixed upstream, with no public exploit identified and no active exploitation reported (SSVC exploitation: none; EPSS 0.58%).

v3 Jul 08, 2026 - 10:31 cvss changed CVSS 8.5

Heap-based code execution in the X.Org libXfont2 font library (versions before 2.0.8) lets an authenticated X client compromise the X server by supplying a malicious PCF font file. The flaw sits in ComputeScaledProperties(), where a missing bounds check on the property buffer allows a heap overflow (CWE-122) that can be leveraged to run attacker code with the X server's privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 8.5 rating is driven by the scope-changing server compromise rather than by trivial reachability, since exploitation requires an authenticated client and has high attack complexity.

v2 Jul 08, 2026 - 10:30 cvss changed CVSS 8.5

Heap-based buffer overflow in the X.Org libXfont2 font library (versions before 2.0.8) lets an authenticated X client execute arbitrary code inside the X server. The flaw lives in ComputeScaledProperties() where a missing size check on the property buffer allows a crafted PCF font file to overflow the heap. No public exploit has been identified at time of analysis, but because the X server typically runs at elevated privilege and the CVSS scope is changed, successful exploitation yields code execution beyond the attacker's original context.

v1 Jul 08, 2026 - 02:20

Heap buffer overflow in libXfont2's ComputeScaledProperties() function allows an attacker controlling a malicious PCF font to write attacker-controlled data past a fixed 70-slot property buffer with no bounds checking. Affected are all deployments of libXfont2 prior to version 2.0.8, meaning any X.Org X server linked against the vulnerable library. No public exploit code has been identified at time of analysis, but upstream fix commits are publicly accessible via GitLab. EPSS data is not available for this CVE.

RemediationAI

Vendor-released patch: upgrade libXfont2 to 2.0.8 or later, which contains the three upstream fixes (freedesktop.org GitLab commits be0b08e2d354138d3222b4490e2a77c6ee42f778, dff957a5158da038a282a59a31fe736702732939, and b4389e0b1d84a690b819bb27b1439968811a3674); apply your distribution's updated package as soon as it is available. If you cannot patch immediately, reduce exposure by removing or restricting untrusted bitmap/PCF font directories and disabling any font server (xfs) or remote font path that lets untrusted clients supply fonts, accepting that legacy bitmap fonts will become unavailable to applications that rely on them. On multi-user hosts, tighten X server client access (e.g., avoid granting X access to untrusted local users) to limit who can push a malicious font, at the cost of breaking shared-display workflows. Reference the oss-security advisory at https://seclists.org/oss-sec/2026/q3/93 for authoritative details.

Affected VersionsENISA

libXfont2 0 <2.0.8

Affected Packages

euvd libxfont2 fix: 2.0.8

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libXfont2 is the X.Org font-handling library used by the Xorg display server (and utilities like xfs) to load and rasterize legacy bitmap fonts. The vulnerability is in its PCF (Portable Compiled Font) parser: ComputeScaledProperties() computes scaled font properties into a property buffer without validating that the number/size of properties fits the allocated space, producing a classic heap-based buffer overflow (CWE-122) driven by attacker-controlled font metadata. Because font parsing executes in-process within the X server, corrupting its heap can be leveraged toward control-flow hijack. The affected CPE is cpe:2.3:a:x:libxfont:*, and the fix spans three upstream commits (be0b08e2, dff957a5, b4389e0b) on freedesktop.org GitLab.

Know when Libxfont gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY HIGH
NVD 8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Requires an authenticated X client (PR:L) and, realistically, local access to the X server (AV:L); crafted-but-simple font trigger (AC:L) yields full code execution in the server, so C/I/A all High.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.3 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Red Hat 7.3 HIGH

Primary rating from Vendor (CNA).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 09, 2026 - 20:00 vuln.today
v5 - CVSS changed
Analysis Updated
Jul 09, 2026 - 19:59 vuln.today
v4 - CVSS changed
CVSS changed
Jul 09, 2026 - 19:52 NVD
8.5 (HIGH) 8.8 (HIGH)
Patch available
Jul 08, 2026 - 11:01 EUVD
Analysis Updated
Jul 08, 2026 - 10:31 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 08, 2026 - 10:30 vuln.today
v2 - CVSS changed
CVSS changed
Jul 08, 2026 - 10:22 NVD
8.5 (HIGH)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Zero Day Initiative Advisories

ZDI-26-408 X.Org Server ComputeScaledProperties Heap-based Buffer Overflow Privilege Escalation Vulnerability Jul 2026

Executive ViewAI

Why It Matters

libXfont2 before version 2.0.8 contains an arbitrary code execution vulnerability affecting X11 server environments on Linux systems. Successful exploitation would grant attackers root-level access to compromised systems. Organizations operating X11-based infrastructure should prioritize patching to prevent complete system compromise.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.6%
Top 56% exploitable
Prevalence
High
core X.Org font library on most Linux Xorg desktops/servers
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

45
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Related Vulnerabilities in libXfont2 Security Flaws

View all 3
CVE-2026-56001 HIGH
8.8
CVE-2026-56002 HIGH
8.8

More in Libxfont

View all
CVE-2013-6462 CRITICAL POC
9.3 Jan 09

Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 al
CVE-2015-1804 HIGH
8.5 Mar 20

The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not proper
CVE-2015-1802 HIGH
8.5 Mar 20

The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote a
CVE-2015-1803 HIGH
8.5 Mar 20

The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not proper
CVE-2014-0211 HIGH
7.5 May 15

Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org

CVE-2014-0210 HIGH
7.5 May 15

Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execu
CVE-2017-13722 HIGH
7.1 Oct 11

In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary

CVE-2017-13720 HIGH
7.1 Oct 11

In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with acce
CVE-2017-16611 MEDIUM
5.5 Dec 01

In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as roo
CVE-2014-0209 MEDIUM
4.6 May 15

Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/kiosk/xorg:21.1-82.11 Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:47103 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/b4389e0b1d84a690b819bb27b1439968811a3674 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/be0b08e2d354138d3222b4490e2a77c6ee42f778 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/dff957a5158da038a282a59a31fe736702732939 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-56003 ADVISORY https://seclists.org/oss-sec/2026/q3/93 ADVISORY https://ubuntu.com/security/notices/USN-8560-1 ADVISORY https://vuldb.com/vuln/376821 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22614/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2793/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2794/ REF https://www.openwall.com/lists/oss-security/2026/07/08/1

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy