Skip to main content

libXfont2 CVE-2026-56003

| EUVDEUVD-2026-42212 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-07-08 GHSA-3v92-8994-jg8p
Buffer Overflow Heap Overflow Red Hat Suse Libxfont
8.8
CVSS 3.1 · NVD
Share

Severity by source

Vendor (CNA) PRIMARY
HIGH
qualitative
NVD
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Requires an authenticated X client (PR:L) and, realistically, local access to the X server (AV:L); crafted-but-simple font trigger (AC:L) yields full code execution in the server, so C/I/A all High.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.3 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

9
Analysis Updated
Jul 09, 2026 - 20:00 vuln.today
v5 (cvss_changed)
Analysis Updated
Jul 09, 2026 - 19:59 vuln.today
v4 (cvss_changed)
CVSS changed
Jul 09, 2026 - 19:52 NVD
8.5 (HIGH) 8.8 (HIGH)
Patch available
Jul 08, 2026 - 11:01 EUVD
Analysis Updated
Jul 08, 2026 - 10:31 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 08, 2026 - 10:30 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 08, 2026 - 10:22 vuln.today
cvss_changed
CVSS changed
Jul 08, 2026 - 10:22 NVD
8.5 (HIGH)
Analysis Generated
Jul 08, 2026 - 02:20 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Arbitrary code execution in libXfont2 before 2.0.8 lets an authenticated X client corrupt heap memory inside the X server via a maliciously crafted PCF bitmap font. The flaw sits in ComputeScaledProperties(), where a missing bounds check on the property buffer allows a heap overflow (CWE-122) that runs in the X server's security context - typically root on traditional Linux desktops. There is no public exploit identified at time of analysis; EPSS is modest at 0.58% and CISA SSVC rates exploitation as 'none' with 'total' technical impact.

Technical ContextAI

libXfont2 is the X.Org font-handling library used by the Xorg display server (and utilities like xfs) to load and rasterize legacy bitmap fonts. The vulnerability is in its PCF (Portable Compiled Font) parser: ComputeScaledProperties() computes scaled font properties into a property buffer without validating that the number/size of properties fits the allocated space, producing a classic heap-based buffer overflow (CWE-122) driven by attacker-controlled font metadata. Because font parsing executes in-process within the X server, corrupting its heap can be leveraged toward control-flow hijack. The affected CPE is cpe:2.3:a:x:libxfont:*, and the fix spans three upstream commits (be0b08e2, dff957a5, b4389e0b) on freedesktop.org GitLab.

RemediationAI

Vendor-released patch: upgrade libXfont2 to 2.0.8 or later, which contains the three upstream fixes (freedesktop.org GitLab commits be0b08e2d354138d3222b4490e2a77c6ee42f778, dff957a5158da038a282a59a31fe736702732939, and b4389e0b1d84a690b819bb27b1439968811a3674); apply your distribution's updated package as soon as it is available. If you cannot patch immediately, reduce exposure by removing or restricting untrusted bitmap/PCF font directories and disabling any font server (xfs) or remote font path that lets untrusted clients supply fonts, accepting that legacy bitmap fonts will become unavailable to applications that rely on them. On multi-user hosts, tighten X server client access (e.g., avoid granting X access to untrusted local users) to limit who can push a malicious font, at the cost of breaking shared-display workflows. Reference the oss-security advisory at https://seclists.org/oss-sec/2026/q3/93 for authoritative details.

More in Libxfont

View all
CVE-2013-6462 CRITICAL POC
9.3 Jan 09

Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 al
CVE-2015-1804 HIGH
8.5 Mar 20

The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not proper
CVE-2026-56002 HIGH
8.8 Jul 08

Heap-based code execution in libXfont2 before 2.0.8 allows an authenticated X client to run arbitrary code inside the X

CVE-2026-56001 HIGH
8.8 Jul 08

Arbitrary code execution in the X.Org libXfont2 library (versions before 2.0.8) stems from a heap buffer overflow in the
CVE-2015-1802 HIGH
8.5 Mar 20

The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote a
CVE-2015-1803 HIGH
8.5 Mar 20

The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not proper
CVE-2014-0211 HIGH
7.5 May 15

Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org

CVE-2014-0210 HIGH
7.5 May 15

Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execu
CVE-2017-13722 HIGH
7.1 Oct 11

In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary

CVE-2017-13720 HIGH
7.1 Oct 11

In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with acce
CVE-2017-16611 MEDIUM
5.5 Dec 01

In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as roo
CVE-2014-0209 MEDIUM
4.6 May 15

Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/kiosk/xorg:21.1-82.11 Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

Share

CVE-2026-56003 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy