Description
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.

A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.
Published: 2026-09-10
Score: 9.5 Critical
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the intended buffer. If the X server runs as a privileged user, this could result in privilege escalation, allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to a denial of service, causing the system to crash. fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.
Title libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 cvssV4_0

{'score': 9.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

cvssV3_1

{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Fri, 07 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Libxfonts2
Libxfonts2 libxfont2
Vendors & Products Libxfonts2
Libxfonts2 libxfont2

Thu, 06 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the intended buffer. If the X server runs as a privileged user, this could result in privilege escalation, allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to a denial of service, causing the system to crash.
Title libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client
Weaknesses CWE-120
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Subscriptions

Libxfonts2 Libxfont2
cve-icon MITRE

Status: PUBLISHED

Assigner: suse

Published:

Updated: 2026-09-10T08:19:55.462Z

Reserved: 2026-05-08T12:29:48.969Z

Link: CVE-2026-44950

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-10T09:17:02.490

Modified: 2026-09-10T09:17:02.490

Link: CVE-2026-44950

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-05T10:00:00Z

Links: CVE-2026-44950 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T10:00:06Z

Weaknesses