A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libXfont2-develUpgrade libXfont2 | Jul 30, 2026 | Jul 28, 2026 |
| Alpine Linux | — | Upgrade libxfont2 | Jul 9, 2026 | Jul 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libXfont2Upgrade libXfont-debuginfoUpgrade libXfont-develUpgrade libXfont2-debuginfoUpgrade libXfontUpgrade libXfont2-devel | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade libXfont2Upgrade libXfont2-debugsourceUpgrade libXfont2-develUpgrade libXfont2-debuginfo | Jul 21, 2026 | Jul 8, 2026 |
| Debian | — | Upgrade libxfont | Jul 13, 2026 | Jul 13, 2026 |
| Freebsd | — | Upgrade libXfont2 | Jul 9, 2026 | Jul 8, 2026 |
| Redhat_linux | — | Upgrade libXfont2-debugsourceUpgrade libXfont2-debuginfoUpgrade libXfont2Upgrade libXfont2-devel | Jul 30, 2026 | Jul 8, 2026 |
| Rocky_linux | — | Upgrade libXfont2-debuginfoUpgrade libXfont2-debugsourceUpgrade libXfont2Upgrade libXfont2-devel | Jul 30, 2026 | Jul 29, 2026 |
| Ubuntu | — | Upgrade libxfont2Upgrade libxfont2 (Ubuntu Pro)Upgrade libxfont1 (Ubuntu Pro) | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub