Every CVE Search/ Get API key

CVE-2026-44950

fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2

9.5 CriticalFix available

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.

A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.26%Down 0.2 points since Sep 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.5

fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.

A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Record
CVE-2026-44950
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2026-75306 9.5

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.

A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Record
EUVD-2026-75306
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-72vv-3gwg-8289 9.5

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap...

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.

A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Record
GHSA-72vv-3gwg-8289
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
NVD 9.5

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.

A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Record
CVE-2026-44950
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
OSVDEBIAN-CVE-2026-44950 9.5

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Record
DEBIAN-CVE-2026-44950
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-3466 7.5

libXfont2 security update

libXfont provides the core of the legacy X11 font system, handling the index files (fonts.dir, fonts.alias, fonts.scale), the various font file formats, and rasterizing them. contains runtime library.

Security Fix(es):

A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fs_read_glyphs() function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the intended buffer. If the X server runs as a privileged user, this could result in privilege escalation, allowing an attacker to gain higher access. If the X server runs as an unprivileged user, it could lead to a denial of service, causing the system to crash.(CVE-2026-44950)

A flaw was found in the libXfont2 font-server client. A remote attacker, by operating a malicious font server, could exploit an out-of-bounds read/write vulnerability. This occurs because the client incorrectly handles font data, leading to an out-of-bounds memory access. This can lead to privilege escalation if the X server runs with root privileges, or a denial of service (crash) if it runs as an unprivileged user.(CVE-2026-59679)

Record
OESA-2026-3466
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 30 moreShow less
OSVRHSA-2026:55446 7.5

Red Hat Security Advisory: libXfont2 security update

Record
RHSA-2026:55446
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:55447 7.5

Red Hat Security Advisory: libXfont2 security update

Record
RHSA-2026:55447
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:55448 7.5

Red Hat Security Advisory: libXfont2 security update

Record
RHSA-2026:55448
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:59311 7.5

Red Hat Security Advisory: libXfont2 security update

Record
RHSA-2026:59311
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:59312 7.5

Red Hat Security Advisory: libXfont2 security update

Record
RHSA-2026:59312
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:61390 7.5

Red Hat Security Advisory: libXfont2 security update

Record
RHSA-2026:61390
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:61755 7.5

Red Hat Security Advisory: libXfont2 security update

Record
RHSA-2026:61755
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:61756 7.5

Red Hat Security Advisory: libXfont2 security update

Record
RHSA-2026:61756
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:61995 7.5

Red Hat Security Advisory: libXfont2 security update

Record
RHSA-2026:61995
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:62123 7.5

Red Hat Security Advisory: libXfont2 security update

Record
RHSA-2026:62123
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:62231 7.5

Red Hat Security Advisory: libXfont2 security update

Record
RHSA-2026:62231
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:55446 7.5

Important: libXfont2 security update

X.Org X11 libXfont2 runtime library

Security Fix(es):

  • libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)

  • libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55446
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:55447 7.5

Important: libXfont2 security update

X.Org X11 libXfont2 runtime library

Security Fix(es):

  • libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)

  • libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55447
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:55448 7.5

Important: libXfont2 security update

X.Org X11 libXfont2 runtime library

Security Fix(es):

  • libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)

  • libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55448
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-44950 9.5

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Record
UBUNTU-CVE-2026-44950
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:55446 No score

Important: libXfont2 security update

X.Org X11 libXfont2 runtime library

Security Fix(es):

  • libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)
  • libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55446
Updated
2026-11-02
OSVALSA-2026:55447 No score

Important: libXfont2 security update

X.Org X11 libXfont2 runtime library

Security Fix(es):

  • libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)
  • libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55447
Updated
2026-11-02
OSVALSA-2026:55448 No score

Important: libXfont2 security update

X.Org X11 libXfont2 runtime library

Security Fix(es):

  • libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679)
  • libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55448
Updated
2026-11-02
OSVAZL-101733 No score

CVE-2026-44950 affecting package libXfont2 for versions less than 2.0.9-1

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation.

A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

Record
AZL-101733
Updated
2026-11-02
OSVCLSA-2026-1787150510 No score

libXfont2: Fix of 2 CVEs

  • Fix CVE-2026-59679: out-of-bounds read/write in fs_read_glyphs due to num_chars not being validated against the allocated encoding array size in fserve.c (upstream commit 668fea81f40bcb48ec67fb55d0b851049d265290)
  • Fix CVE-2026-44950: heap buffer overflow in fs_read_glyphs due to a missing bounds check on cumulative glyph data writes into the allbits buffer in fserve.c (upstream commit c2d222bb22c623d8a40f3275077fc7e6617f2c8a)
Record
CLSA-2026-1787150510
Updated
2026-11-02
OSVCLSA-2026-1787162017 No score

libXfont2: Fix of 2 CVEs

  • CVE-2026-59679: validate num_chars against the encoding array size in fs_read_glyphs() in src/fc/fserve.c; prevents an out-of-bounds read/write on encoding[] when a font server sends more glyphs than extents (upstream commit 668fea81f40bcb48ec67fb55d0b851049d265290)
  • CVE-2026-44950: bounds-check cumulative glyph data writes in fs_read_glyphs() in src/fc/fserve.c; prevents a heap buffer overflow from overlapping source offsets whose total length exceeds the allocated bitmap buffer (upstream commit c2d222bb22c623d8a40f3275077fc7e6617f2c8a)
Record
CLSA-2026-1787162017
Updated
2026-11-02
OSVCLSA-2026-1790784764 No score

libXfont2: Fix of 2 CVEs

  • rebase to 2.0.3-1.0.3.el7
  • the vendor fixes in this build: CVE-2026-44950, CVE-2026-59679
  • drop the 3 TuxCare CVE backports; the vendor now ships their own patches for them
  • no TuxCare CVE patches remain
Record
CLSA-2026-1790784764
Updated
2026-11-02
OSVCLSA-2026-1790786405 No score

libXfont2: Fix of 2 CVEs

  • rebase to 2.0.3-1.0.3.el7
  • the vendor fixes in this build: CVE-2026-44950, CVE-2026-59679
  • drop the 3 TuxCare CVE backports; the vendor now ships their own patches for them
  • no TuxCare CVE patches remain
Record
CLSA-2026-1790786405
Updated
2026-11-02
OSVMGASA-2026-0471 No score

Updated libxfont2 package fixes security vulnerabilities

fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2. (CVE-2026-44950) fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2. (CVE-2026-59679)

Record
MGASA-2026-0471
Updated
2026-11-02
OSVopenSUSE-SU-2026:11463-1 No score

libXfont2-2-2.0.7-3.1 on GA media

These are all security issues fixed in the libXfont2-2-2.0.7-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11463-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21539-1 No score

Security update for libXfont2

This update for libXfont2 fixes the following issues:

  • CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).
  • CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).
Record
openSUSE-SU-2026:21539-1
Updated
2026-11-02
OSVSUSE-SU-2026:23128-1 No score

Security update for libXfont2

This update for libXfont2 fixes the following issues:

  • CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).
  • CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).
Record
SUSE-SU-2026:23128-1
Updated
2026-11-02
OSVSUSE-SU-2026:23151-1 No score

Security update for libXfont2

This update for libXfont2 fixes the following issues:

  • CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).
  • CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).
Record
SUSE-SU-2026:23151-1
Updated
2026-11-02
OSVSUSE-SU-2026:3499-1 No score

Security update for libXfont2

This update for libXfont2 fixes the following issues:

  • CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).
  • CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).
Record
SUSE-SU-2026:3499-1
Updated
2026-11-02
OSVSUSE-SU-2026:3500-1 No score

Security update for libXfont2

This update for libXfont2 fixes the following issues:

  • CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661).
  • CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#1272660).
Record
SUSE-SU-2026:3500-1
Updated
2026-11-02

Affected products

Show 68 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
libXfont2
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.0.3-2.el8_10.3
2.0.3-2.el8_10.3
libXfont2-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.0.3-2.el8_10.3
2.0.3-2.el8_10.3
libXfont2
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.0.3-12.el9_8.3
2.0.3-12.el9_8.3
libXfont2-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.0.3-12.el9_8.3
2.0.3-12.el9_8.3
libXfont2
AlmaLinux:10
From an advisory covering 2 CVEs
 before 2.0.6-5.el10_2.3
2.0.6-5.el10_2.3
libXfont2-devel
AlmaLinux:10
From an advisory covering 2 CVEs
 before 2.0.6-5.el10_2.3
2.0.6-5.el10_2.3
libXfont2
Azure Linux:3
 before 2.0.9-1
2.0.9-1
libXfont2
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 2.0.3-12.el9_2.tuxcare.els4
2.0.3-12.el9_2.tuxcare.els4
libXfont2-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 2.0.3-12.el9_2.tuxcare.els4
2.0.3-12.el9_2.tuxcare.els4
libXfont2
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 2.0.3-12.el9_6.tuxcare.els4
2.0.3-12.el9_6.tuxcare.els4
Show 88 moreShow less
Affected packages
PackageAffectedFixed
libXfont2-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 2.0.3-12.el9_6.tuxcare.els4
2.0.3-12.el9_6.tuxcare.els4
libXfont2
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 2.0.3-1.0.3.el7_9.tuxcare.els1
2.0.3-1.0.3.el7_9.tuxcare.els1
libXfont2-devel
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 2.0.3-1.0.3.el7_9.tuxcare.els1
2.0.3-1.0.3.el7_9.tuxcare.els1
libXfont2
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 2.0.3-1.0.3.el7_9.tuxcare.els1
2.0.3-1.0.3.el7_9.tuxcare.els1
libXfont2-devel
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 2.0.3-1.0.3.el7_9.tuxcare.els1
2.0.3-1.0.3.el7_9.tuxcare.els1
libxfont
Debian:12
 All versions, plus listed versions
1:2.0.6-11:2.0.6-1+deb12u11:2.0.6-1+hurd.11:2.0.6-21:2.0.8-11:2.0.9-1
 None known
libxfont
Debian:13
 All versions, plus listed versions
1:2.0.6-11:2.0.6-1+deb13u11:2.0.6-1+hurd.11:2.0.6-21:2.0.8-11:2.0.9-1
 None known
libxfont
Debian:14
 before 1:2.0.9-1, plus listed versions
1:2.0.6-11:2.0.6-1+hurd.11:2.0.6-21:2.0.8-1
1:2.0.9-1
libxfont2
Mageia:10
From an advisory covering 2 CVEs
 before 2.0.9-1.mga10
2.0.9-1.mga10
libXfont2
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.0.5-6.oe2203sp4
2.0.5-6.oe2203sp4
libXfont2
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.0.6-4.oe2403sp1
2.0.6-4.oe2403sp1
libXfont2
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 2.0.6-4.oe2403sp3
2.0.6-4.oe2403sp3
libXfont2
openEuler:24.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.0.6-4.oe2403sp4
2.0.6-4.oe2403sp4
libXfont2
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.0.4-3.oe2003sp4
2.0.4-3.oe2003sp4
libXfont2
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_10.3
0:2.0.3-2.el8_10.3
libXfont2-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_10.3
0:2.0.3-2.el8_10.3
libXfont2-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_10.3
0:2.0.3-2.el8_10.3
libXfont2-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_10.3
0:2.0.3-2.el8_10.3
libXfont2-debugsource
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_10.3
0:2.0.3-2.el8_10.3
libXfont2-devel
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_10.3
0:2.0.3-2.el8_10.3
libXfont2
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_8.3
0:2.0.3-12.el9_8.3
libXfont2-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_8.3
0:2.0.3-12.el9_8.3
libXfont2-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_8.3
0:2.0.3-12.el9_8.3
libXfont2-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_8.3
0:2.0.3-12.el9_8.3
libXfont2-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_8.3
0:2.0.3-12.el9_8.3
libXfont2-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_8.3
0:2.0.3-12.el9_8.3
libXfont2
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:2.0.6-5.el10_2.3
0:2.0.6-5.el10_2.3
libXfont2-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:2.0.6-5.el10_2.3
0:2.0.6-5.el10_2.3
libXfont2-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:2.0.6-5.el10_2.3
0:2.0.6-5.el10_2.3
libXfont2-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:2.0.6-5.el10_2.3
0:2.0.6-5.el10_2.3
libXfont2
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_2.3
0:2.0.3-12.el9_2.3
libXfont2-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_2.3
0:2.0.3-12.el9_2.3
libXfont2-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_2.3
0:2.0.3-12.el9_2.3
libXfont2
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_4.3
0:2.0.3-12.el9_4.3
libXfont2-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_4.3
0:2.0.3-12.el9_4.3
libXfont2-debugsource
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_4.3
0:2.0.3-12.el9_4.3
libXfont2
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_6.3
0:2.0.3-12.el9_6.3
libXfont2-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_6.3
0:2.0.3-12.el9_6.3
libXfont2-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_6.3
0:2.0.3-12.el9_6.3
libXfont2-debuginfo
Red Hat:rhel_eus:9.6::crb
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_6.3
0:2.0.3-12.el9_6.3
libXfont2-debugsource
Red Hat:rhel_eus:9.6::crb
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_6.3
0:2.0.3-12.el9_6.3
libXfont2-devel
Red Hat:rhel_eus:9.6::crb
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_6.3
0:2.0.3-12.el9_6.3
libXfont2
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_6.2
0:2.0.3-2.el8_6.2
libXfont2-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_6.2
0:2.0.3-2.el8_6.2
libXfont2-debugsource
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_6.2
0:2.0.3-2.el8_6.2
libXfont2
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_6.2
0:2.0.3-2.el8_6.2
libXfont2-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_6.2
0:2.0.3-2.el8_6.2
libXfont2-debugsource
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_6.2
0:2.0.3-2.el8_6.2
libXfont2
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_8.2
0:2.0.3-2.el8_8.2
libXfont2-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_8.2
0:2.0.3-2.el8_8.2
libXfont2-debugsource
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_8.2
0:2.0.3-2.el8_8.2
libXfont2
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_8.2
0:2.0.3-2.el8_8.2
libXfont2-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_8.2
0:2.0.3-2.el8_8.2
libXfont2-debugsource
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_8.2
0:2.0.3-2.el8_8.2
libXfont2
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_4.2
0:2.0.3-2.el8_4.2
libXfont2-debuginfo
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_4.2
0:2.0.3-2.el8_4.2
libXfont2-debugsource
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_4.2
0:2.0.3-2.el8_4.2
libXfont2
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_4.2
0:2.0.3-2.el8_4.2
libXfont2-debuginfo
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_4.2
0:2.0.3-2.el8_4.2
libXfont2-debugsource
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_4.2
0:2.0.3-2.el8_4.2
libXfont2
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:2.0.6-5.el10_0.2
0:2.0.6-5.el10_0.2
libXfont2-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:2.0.6-5.el10_0.2
0:2.0.6-5.el10_0.2
libXfont2-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:2.0.6-5.el10_0.2
0:2.0.6-5.el10_0.2
libXfont2-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:2.0.6-5.el10_0.2
0:2.0.6-5.el10_0.2
libXfont2
Red Hat:rhel_els:7
From an advisory covering 2 CVEs
 before 0:2.0.3-3.el7_9
0:2.0.3-3.el7_9
libXfont2-debuginfo
Red Hat:rhel_els:7
From an advisory covering 2 CVEs
 before 0:2.0.3-3.el7_9
0:2.0.3-3.el7_9
libXfont2-devel
Red Hat:rhel_els:7
From an advisory covering 2 CVEs
 before 0:2.0.3-3.el7_9
0:2.0.3-3.el7_9
libXfont2
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2.0.3-2.el8_10.3
0:2.0.3-2.el8_10.3
libXfont2
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2.0.3-12.el9_8.3
0:2.0.3-12.el9_8.3
libXfont2
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:2.0.6-5.el10_2.3
0:2.0.6-5.el10_2.3
libXfont2
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 2.0.7-160000.5.1
2.0.7-160000.5.1
libXfont2
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 2.0.7-160000.5.1
2.0.7-160000.5.1
libXfont2
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 2 CVEs
 before 2.0.3-3.6.1
2.0.3-3.6.1
libXfont2
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 2 CVEs
 before 2.0.3-3.6.1
2.0.3-3.6.1
libXfont2
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 2.0.3-150000.3.6.1
2.0.3-150000.3.6.1
libXfont2
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 2.0.3-150000.3.6.1
2.0.3-150000.3.6.1
libXfont2
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 2.0.3-150000.3.6.1
2.0.3-150000.3.6.1
libXfont2
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 2.0.3-150000.3.6.1
2.0.3-150000.3.6.1
libXfont2
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 2.0.3-150000.3.6.1
2.0.3-150000.3.6.1
libXfont2
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 2.0.3-150000.3.6.1
2.0.3-150000.3.6.1
libXfont2
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 2.0.3-150000.3.6.1
2.0.3-150000.3.6.1
libXfont2
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 2.0.3-150000.3.6.1
2.0.3-150000.3.6.1
libXfont2
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 2.0.3-150000.3.6.1
2.0.3-150000.3.6.1
libXfont2
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 2.0.3-150000.3.6.1
2.0.3-150000.3.6.1
libXfont2
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 2.0.3-150000.3.6.1
2.0.3-150000.3.6.1
libxfont2
Ubuntu:16.04:LTS
 All versions, plus listed versions
1:2.0.1-3~ubuntu16.04.11:2.0.1-3~ubuntu16.04.21:2.0.1-3~ubuntu16.04.3
 None known
libXfont2
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.0.7-3.1
2.0.7-3.1
libXfont2
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 2.0.7-160000.5.1
2.0.7-160000.5.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-44950 is a critical vulnerability (CVSS 9.5) in Libxfont, published August 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in libXfont2 2.0.9-1.

References

Show 55 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open