fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.
CVSS Details
- CVSS 4.0 Base Score: 9.2 (CRITICAL)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libXfont2-develUpgrade libXfont2 | Oct 11, 2026 | Aug 17, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libXfont2Upgrade libXfont2-develUpgrade libXfontUpgrade libXfont-debuginfoUpgrade libXfont2-debuginfoUpgrade libXfont-devel | Oct 19, 2026 | Oct 19, 2026 |
| Freebsd | — | Upgrade libXfont2 | Aug 10, 2026 | Aug 7, 2026 |
| Oracle_linux | — | Upgrade libXfont2Upgrade libXfont2-devel | Oct 22, 2026 | Sep 10, 2026 |
| Redhat_linux | — | Upgrade libXfont2-develUpgrade libXfont2-debugsourceUpgrade libXfont2Upgrade libXfont2-debuginfo | Aug 10, 2026 | Aug 5, 2026 |
| Rocky_linux | — | Upgrade libXfont2-debuginfoUpgrade libXfont2Upgrade libXfont2-debugsourceUpgrade libXfont2-devel | Aug 20, 2026 | Aug 17, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub